Taint tracking is not a search problem. It is a flow problem.

Efficiency is often a mask for incompleteness. In dynamic taint tracking, the goal is to map how data moves from a source to a sink. The standard way to do this is heavy-handed: you instrument everything, adding parallel variables for every actual variable and inserting bytecode instructions to track the flow.