The model I was thinking of was native code in the native app, injected polyfill that talks to the native code over a message bus. The native code can draw over the top of the web view and pass messages in. Is there anything in particular stopping that?
I've heard mixed reports on this - the big issue is technical in that you can't implement your own JIT Javascript engine, because only JavaScriptCore (running out-of-process) can write executable pages.