I'm QA with some programming experience, so I am able to debug and review the code of the system under test. I also often read the code to understand how to define request or what response should I expect if documentation is rudimentary (yea, I know system under test should not be treated as an expected result reference...).
Reporting potential bugs
It happens that during such a review or debugging of some problem found during tests I find another bug. For instance, I find that parameters passed to the client stub are not forwarded in Web service request. From Web service documentation I conclude this may cause integration defect (for instance, it may change the semantics of the requests or cause service failure for a mandatory parameter).
I report this as a bug and describe the potential effect, but I have no time to implement a full test to provoke such failure. Still, developers keep asking me to specify steps to reproduce the bug and an actual effect and impact.
Is it fair to report a bug discovered during review without performing a test?
Reporting API quality
A subset of problems I find do not impact application behavior but refers to API quality. For instance, I find subsystem API with a superfluous parameter that is never used by the component but confuses both developers and testers using this API ("what value should I put here?").
Should I report such problems in a bug tracking system?