How to find potential points of NullReferenceException in a static code analyzer utility?

We're developing a static code analysis tool that aims at improving code via some hints.

We want to find places where developer has forgotten to check nullability of a variable or property or method return and has accessed the members via Dot Notation, because it might encounter NullReferenceException.

For example this code:

class Program
{
    static void Main(string[] args)
    {
        var human = new Human();
        if (human.Name.Length > 10)
        {
            // Jeez! you have a long name;
        }
    }
}

public class Human
{
    public string Name { get; set; }
}

We use Mono.Cecil and we find the body of all methods of all types in a given assembly, and for each method body we find the Instructions of it, and then we check for Callvirt operations. Yet that doesn't support this example:

class Program
{
    static string name;

    static void Main(string[] args)
    {
        if (name.Length > 10)
        {
        }
    }
}

How can we find all of the accesses to members (variable, field, property, method) of a given nullable type?