While I don't work on any of the related pieces, it should be noted that NaCL has dynamic "check this code" support precisely so you can JIT-compile code and execute it safely.