FWIW, I tried Facebook's infer [1] with Lua 5.1.3 rc2 and found nothing (besides some false positives)