This would be awesome. We enabled this for FastMalloc, and although the JSC allocator isn't technically a malloc, it might be able to give some meaningful information about where JS objects are being allocated. I'm not sure how invasive it would be though.
We would have to disable inline object allocations in the JITs, but that's easily done with a runtime flag.