\[~nicolas.peru] and [~pierre-yves.nicolas], for me here there is no need (at least for a first valuable implementation) to have the CFG. Indeed, as soon as there is a statement "return null;" in the body of a toString() method, this is enough to raise an issue without generating any false-positives.