The whole point of a JIT is that you don't do naive variable name lookup.

With a proper intermediate representation you'd connect that $$ variable lookup directly to the original variable's edge.

Isn't reflection slow as hell?

If not please correct me.

It's less fast than direct lookups, but if the compiler supports it properly, it shouldn't be any slower than a associative array lookup.

  echo $FOO[$BAR];
  echo $$BAZ;
  >>>
  
  push FOO.ptr
  push BAR.ptr
  call hash_get
  push ax
  call print
  
  push local_table // static per compiled scope
  push BAZ.ptr
  call hash_get
  push [ax+24] // entry->value
  call print

You'd probably want to add error handling (to both cases) and accessing a global variable that didn't exist when the code was compiled will likely be slow, but if becomes a preformance bottleneck you can always rewrite it to something easier to compile.

And of course a smart JIT compiler can even put the variable access lookup in an inline cache on the function so that in the future it's a direct type + key = offset calculation rather than a memory lookup and the hash_get call is avoided.

True. I was aiming for the simplest example that could pass as real general-case-ish assembly; there's plenty of room for improvement.