Reference1
If the program includes the use of a procedure parameter or functin pointer, the target generally is not known until the program is run and, in fact, may vary from one invocation to another. Then, a call site can link to many or all procedures in the call graph.
Indirect calls are the norm for object-oriented programming languages. When there is overriding of methods in subclasses, a use of method m may refer to any of a number of different methods, depending on the subclass of the receiver object to which it was applied. The use of such virtual method invocations means that we need to know the type of the receiver before we can determine which method is invoked.
If you could revise
the fundmental principles of
computer system design
to improve security...
... what would you change?