PadWalker is the closest, but I'd probably use the B:: modules. If you turn the subref into a B::OP descendant, you can walk the execution path, looking for ops that access either a pad or a stash. It's not terribly difficult to figure out which variable they want from there.

The tricky part is figuring out whether it's a global or a lexical variable (and which pad holds the lexical).