There is a ~9 year old buffer overflow vulnerability in sendmail (crackaddr) that no static analyzer can identify even today (and they are specifically targeting it as a test case).

And what exactly is wrong with the code that passes all the tests and works? Its aesthetics offend you? Should the first priority of code be to work to just work?

Beauty is only a nice-to-have feature. If the pretty way is about as fast to produce as the "lunch in the back of your throat" model, sure lets go pretty. But if it's going to cost me 50% of my developer's time, I'll take the quick and dirty every time.

It's not so much about "beauty", but long-term maintainability of code makes development faster in the long run and reduces the murder rate within your dev team.

The wrong part here is in "passes all the tests and works" assumption. In my experience, static analysis, unit tests and reviews all help minimize errors (amongst their other benefits), ideally you'd make use of all three.

You can write unmaintainable code that is still testable and passes static analysis tests.

> I'll take the quick and dirty every time.

This is gonna start biting you in the ass after a few years.