Cool, once again a managed implementation of JScript faster than the "current" version of IE's native one. When Managed JScript was still on going, it was faster than IE8's interpreter-based JScript.
So SPUR doesn't yet support neseted trace trees. I wonder if they will consider the trace scheme used in LuaJIT 2 where it doesn't use trace trees, but still supports nested loops well. FYI http://lua-users.org/lists/lua-l/2009-11/msg00089.html
The possibility of being able to trace all the way into SPUR itself is also very interesting. That would evolve into another metacircular VM. Hopefully it'll come true some day.