I worked at a place that used a commercial static code analysis system called Coverity Prevent, and it was freaking amazing! It's really sophisticated and intelligent.
We threw about 18 GB of both open-source and proprietary C and C++ code at it, and it would trace through the code paths and quickly find subtle bugs that would take a human forever to track down. It was also great at pinpointing things that would usually be Heisenbugs.
It ran every few days against our code base, and a nice feature was that we could tell it, "This isn't really a bug," and it would remember that in the future.
The gotcha is, Coverity is really expensive. They don't publish the costs, but I get the sense that for commercial projects, it starts in the hundreds of thousands of dollars per year. But it probably saved us having to hire a whole bunch of developers and QA staff, so on the whole our management seemed to think it was a good buy.
Having had that experience, I look quite favorably on static code analysis.