In the browser, event handlers go through nsJSContext::CompileEventHandler and nsJSContext::BindCompiledEventHandler. The result is a function unlike anything we can create in the shell. So we have no shell tests for event-handler-like functions. There are three things going on here. 1. XPConnect makes it possible to build objects that have other objects on the scope chain (DOM Elements are like this whether they have event handlers or not). 2. The event handler code is compiled without the compile-and-go option. 3. The resulting function is then cloned onto a DOM object, which becomes the scope chain for the clone. We can do (3) using the shell's clone() function. If (1) and (2) were possible, I think we'd be all set.