By focusing on the critical path through the call tree. It's shocking how many fatal errors static analysis finds in my typical C/C++/C# code but the call graph that those errors are on simply never gets exercised. The mathematical proof would include all those unused paths.