I wonder how much of these problems static analysis could catch.

Also, does Google use fuzzing to test its own libraries? The original Stagefright bugs were found by a fuzzer: http://lcamtuf.coredump.cx/afl/