I used to work on a static analyzer that did taint analysis, model checking, buffer bounds checking, and so on -- a bit like a compiler backend on steroids. If there's a specific topic you'd like an explanation on, I could be convinced to write something up.
My favorite was always context-sensitive, interprocedural points-to analysis. And dataflow analysis in the presence of higher-order controlflow constructs.