(This below is for Squeak, but probably applies to Pharo too).

You /could/ try and use InstructionStream.  There's a problem here.  For 0-argument sends the problem is simple; simply scan for anInstructionStream willSend following a pushSelf.  But with N-argument sends, argument marshalling bytecodes occur between the pushSelf and the send bytecode.  So you could look at classes such as BlockLocalTempCounter, ClosureExtractor, InstVarRefLocator that implement specific scanning patterns. The idea is to model the stack, e.g. pushing true on a stack whenever the scanner responds to pushSelf, and pushing false when pushing anything else.  Then when encountering a send it checks for true on the stack.