Natively, the objective-c runtime does not have a function to get an instance variable by name so I wrote a function to do so. This works great for inspecting 'concrete' classes.

class_getIvarFromString.m

Ivar class_getIvarFromString(Class cl, NSString *__ivar) {
    unsigned int count;
    Ivar *ivars = class_copyIvarList(cl, &count);
    for (int i = 0; i < count; i++) {
        Ivar ivar = ivars[i];
        NSString *ivarName = [NSString stringWithUTF8String:ivar_getName(ivar)];
        if([ivarName isEqualToString:__ivar]) {
            free(ivars);
            return ivar;
        }
    }
    free(ivars);
    return NULL;
}

int main(int argc, const char * argv[]) {
    @autoreleasepool {
        NSUserNotification *n = [[NSUserNotification alloc] init];
        Ivar retIvar = class_getIvarFromString(object_getClass(n), @"_imageURL");
        printf("%s\n", ivar_getTypeEncoding(retIvar));
    }
}