Failure to detect free-memory access

I have written this query to detect accessing freed pointers using `delete` expression.
```
/**
* @name Use after free
* @id cpp/sei-cert/mem/50
* @kind path-problem
* @problem.severity error
* @tags sei-security
*/
import cpp
import semmle.code.cpp.dataflow.DataFlow
import DataFlow::PathGraph

class Config extends DataFlow::Configuration {
Config() { this = "Get freed memory access." }

override predicate isSource(DataFlow::Node arg) {
exists(FunctionCall call |
call.getArgument(0) = arg.asDefiningArgument() and
call.getTarget().hasGlobalOrStdName("free") )
or
exists( DeleteExpr delexp | delexp.getExpr() = arg.asExpr() )
}

override predicate isSink(DataFlow::Node sink) {
exists( | dereferenced(sink.asExpr()) )
}
}

from Config config, DataFlow::PathNode source, DataFlow::PathNode sink
where config.hasFlowPath(source, sink)
select sink, source, sink, "Memory is $@ and $@, causing a potential vulnerability.", source, "freed here", sink, "used here"
```

and it failed to detect this code snippet even though `ncg0` function frees the `s` pointer then uses it in the same context (i.e. not freed in another function call).

```
struct ncS1 {
void f() {};
};

void ncg0() noexcept(false) {
ncS1 *s = new ncS1;
// ...
delete s;
// ...
s->f();
}
```