class SmallBallOfMud {
    private int state1;
    private int state2;
    private object state3;

    void Method1() {
        state1 = 15;
        state3 = new List<object>();
    }

    void Method2() {
        if (state1 < 10) {
            state2 = 25;
        } else {
            state2 = -1;
        }
        state3 = new object[] { state3 };
    }
}

var variables = typeof(SmallBallOfMud).GetFields(BindingFlags.Instance | BindingFlags.NonPublic);
var methods = typeof(SmallBallOfMud).GetMethods(BindingFlags.Instance | BindingFlags.NonPublic);

var d = new Dictionary<string, List<string>>();
foreach (var v in variables) d.Add(v.Name, new List<string>());

// this particular disassembler chokes on externally implemented methods
foreach (var m in methods.Where(m => (m.MethodImplementationFlags | MethodImplAttributes.IL) == 0)) {
    var instructions = MethodBodyReader.GetInstructions(m);

    foreach (var i in instructions) {
        // we'll only check for direct field access here
        var f = i.Operand as FieldInfo;
        if (f == null) continue;
        d[f.Name].Add(m.Name);
    }
}

// if a method touched a field > 1, it's duped; dedupe and make it a count
foreach (var kvp in d.ToArray()) {
    d[kvp.Key] = kvp.Value.GroupBy(v => v).Select(v => v.First() + " (" + v.Count() + ")").ToList();
}

d.Dump();

state1: Method1 (1), Method2 (1)
state2: Method2 (2)
state3: Method1 (1), Method2 (2)