author here, I have checked this, but the static analysis is good enough that they use run checks on the AST clang parses. The content is thus parsed and `JOIN(exe,cve)` still ends up as a banned symbol in the end.