Static analysis, and the MC project in particular, excites me.
They're now checking filesystems and automatically finding bugs like this:
http://www.ussg.iu.edu/hypermail/linux/kernel/0402.2/2339.html
Which viro confirms is a serious bug.
Look at the report's filesystem image before/after the call. How cool is that? I'd love to see the Metal code that generated that checker.