I've started writing a fuzzer for the JVM once. It looks at the bytecode and adds instrumentation to check whether a label has been hit = a code-path has been traversed after calling methods.

It uses genetic algorithms to spawn agents that call an API with all kinds of arguments and reproduce when it finds unique code-paths.

Before anyone asks: the code is far from complete, it's really more a fiddle than anything.