[andhow]

The VM controls the creation and manipulation of doubles, so beggars and nasties do not have the ability to create a non-canonical NaN.

[jws]

There is a foreign function interface floating around in Mozilla land. js-ctypes. I have no idea how it relates to this javascript engine, but it tantalizes.

[andhow]

js-ctypes goes through the JSAPI, so the JS engine can still guard against rogue NaNs.