Howdy,
Since static analysis seems to have gotten more popular recently, I ran RATS (http://www.fortify.com/security-resources/rats.jsp) on Wine. I uploaded the results to:
http://winezeug.googlecode.com/svn/trunk/rats_output.txt
I'm working on trying Oink!, which is supposed to be pretty good, but I can't get it to compile correctly...I'm still fiddling with it.
-Austin