[analyzer] +Testcase: several used-after-free args passed to a function.