I've used LLVM for some light callgraph analysis to identify when hazardous functions can be called from a 'safe' function. The main application is for realtime audio processing where dynamic memory allocation, IO, and blocking locks can introduce bugs (due to their latency characteristics). Nothing all that fancy, though reconstructing class hierarchies, vtables, templates, etc was a learning curve.
repo: https://github.com/fundamental/stoat
