>>I think you need to determine between operator and operand too. It is bad practice, but it will work to do something like
>>

>>EXECSCRIPT ='Mooh'
>>?EXECSCRIPT+'!'
>>

>>This something different then
>>

>>EXECSCRIPT(somethingunwanted)
>>

>>
>>This is only an example, it's clear that the twoliner will not work, but you have to consider this. Some functions are valid, others not, and not each in all circumstances.
>>
>>Report is even worst, since the datatype of a reportfield is something the user might change for good reason.
>
>Functions names are distinguished from variables names by the ( suffix. For hazard checking it would be enough, wouldn't it? For the rest, the VFP processor would complain during evaluation.

VFP will not complain if some noob uses VFP identifiers for field or variable name.

Also AND ( is no function

In general I think you might only look for function / method names (as you mentioned the stuff infront of ( that is not in the boolean operators). The operators are no problems, operands that are variables, fields or properties to. This could make your search much faster

BTW, I like to point you to following little quirk:

?_screen. caption

is VFP valid.