Hmmm! Wonder how hard it might be to make a build of v8 available that replaces assumes with asserts, and perhaps replaces code believed to be unreachable with assert(false)? If it's something like LLVM IR, where assume is just an intrinsic taking a Boolean expression, would seem relatively straightforwards- would probably need to run before every pass in the optimizer...but should be doable.

Then, take your preferred JS fuzzer...