We have payoff functions described by an expression defined at runtime. For numerical schemes it is helpful to know where the 'kinks' in the payoff are located, for example strike or local barrier level.how best to identify the kinks, even approximately, so that numerical scheme can be concentrated near the kinks, when we only have the expression tree representation of the payoff function from which to sample.

Sounds like a bad design. You should require the user who input the payoff to also input the kink points.

If sampling the function is cheap, then sample it at regular intervals to look for discontinuities in the value or first-derivative of value of the curve.If sampling the function is really cheap, you can double-sample each point (with a delta of spacing) to estimate the local numerical first derivative and make the kink finding a little more certain.If sampling the function is expensive, then look at something like bi-section search to find and refine the locations of the kinks.If sampling the function is expensive and you have some rough estimate of the PDF or CDF of the underlying, you might bias the density of samples or search to higher-density portions of the outcome space.