I'm QA with some programming experience, so I am able to debug and review the code of the system under test. I also often read the code to understand how to define request or what response should I expect, if documentation is rudimentary (yea, I know system under test should not be treated as a expected result reference...).
Reporting potential bugs
It happens that during such a review or debugging of some problem found during tests I find another bug. For instance, I find that parameters passed to the client stub are not forwarded in Web service request. From Web service documentation I conclude this may cause integration defect (for instance, it may change the semantics of the requests or cause service failure for a mandatory parameter).
I report this as a bug and describe potential effect, but I have no time to implement full test to provoke such failure. Still, developers keep asking me to specify steps to reproduce the bug and an actual effect and impact.
Is it fair to report a bug discovered during review without performing a test?
Reporting API quality
A subset of problems I find do not impact application behavior but refers to API quality. For instance, I find subsystem API with superfluous parameter that is never used by the component, but confuses both developers and testers using this API ("what value should I put here?").
Should I report such problems in bug tracking system?