The wrong part here is in "passes all the tests and works" assumption. In my experience, static analysis, unit tests and reviews all help minimize errors (amongst their other benefits), ideally you'd make use of all three.