How do you select non-valid column names used by views / functions and SPs?
In practice, you can't because dynamic SQL is effectively impossible to predict - you can't predict what string is going to be built before it runs. 
Even if you try, queries can have branching logic - for example, based on parameters, you may build different SQL.