Deadalnix, thumbs up for your nice talk!

One question, how can you be sure that the optimizer does not 'improve' your code and (re)introduce those kinds of vulnerabilities you carefully try to eliminate?

Is there any other option than looking at the generated code? For every compiler version?