As discussed in PR #389, the detection of using $this outside of classes is incorrectly reporting this as an error.

I've created a basic example here: https://3v4l.org/VMmcp

$closure = function () {
    return $this->getMessage();
};

class Foo {
    public function getMessage() {
        return "Hello World";
    }
}

$foo = new Foo();
$closure = $closure->bindTo($foo);
echo $closure();

I haven't checked that the scanner will complain about the $this in the second line, but it looks and feels just like the one in my projects. I do understand that tracing the usage of the closure deep into the code until a call to bindTo is made is a real challenge.

As a side note, the Slim part that does the binding is located here: https://github.com/slimphp/Slim/blob/3.8.1/Slim/App.php#L235-L237 - basically you can call App::map on an instance of the object with the route parameters and the closure to be executed OUTSIDE of the class context, but still can access the DI container via $this inside the closure.