Here's the chroot script I run:

    #!/bin/sh

    cp /proc/mounts /usr/local/wheezy/etc/mtab

    mount -o bind /sys /usr/local/wheezy/sys

    mount -o bind /proc /usr/local/wheezy/proc

    mount -o bind /dev/ /usr/local/wheezy/dev

    mount -o bind /dev/pts /usr/local/wheezy/dev/pts

    mount -o bind /tmp /usr/local/wheezy/tmp

    mount -o bind /home/chronos/user/     /usr/local/wheezy/root/chronos

    cp /home/chronos/.Xauthority /usr/local/wheezy/root/

    chroot /usr/local/wheezy/

And then in the chroot I have these lines in my .bashrc:

    export XAUTHORITY=/root/.Xauthority
    export DISPLAY=":1"

But I'm not sure they're actually necessary. I think you might just be able to do:

    DISPLAY=":1" startx &

from the command line to start X.

It seems to require being started from the actual virtual console on Ctl-Alt-F2 rather than from the crosh shell or local ssh.