Found while reviewing #32840
The nullptr witness path was dead in normal code paths: replacing it with reference enables us deleting unreachable logic.
Code coverage proof: https://maflcko.github.io/b-c-cov/total.coverage/src/script/interpreter.cpp.gcov.html#L2135