Exploiting reachability and cardinality in higher-order flow analysis