I realize that things like window.x can be added at runtime, but local scopes ought to be simple to rule out.... as long as there are no calls to eval() .....

eval(), which can introduce local bindings at runtime from arbitrary, runtime-constructed strings....

Ugh.

And since aliases to eval can also be created, in any scope, from other dynamically eval()'d code strings, you can't even be sure that any nonlocal symbol won't resolve to eval.

So the only way you can be sure that a level of scope can be skipped in the lookup chain is if there are no function calls made on any redefinable nonlocal symbols.

If there were a subset of javascript where eval was a keyword instead of an identifier, then this would be easier.