With KLEE you flag interesting variables and then it attempts to examine all the possible code paths dependent on the value (e.g. range) of that variable, generating test cases to intelligently fuzz those paths.
The more code KLEE must examine the more time it takes (hours or days or forever), and it can only handle deterministic code (i.e. no user input), so KLEE is a tool, not a solution. But a very interesting tool.