Implement taintflow.intercept to support runtime interception of AssignmentExpressions like +=.
Maybe it's also a good idea to rewrite expressions like a.b.c += x to temp = a.b, temp.c = temp.c + x (just a.b.c = a.b.c + x causes unwanted side effects), thus delegating interception to BinaryExpression.