After many painful hours of Googling, more Googling, crying, pounding on the desk, and losing my temper in #mono, I have successfully added an ExecuteScript method to jscall, and the corresponding managed binding! With one method call in managed world it is now possible to execute an arbitrary script, passed as a string, inside of a Gecko# WebControl.
Combined with the already-existing jscall features, this means that the glue library can be injected into any page loaded in a WebControl, regardless of how that page was loaded!
I plan to reward myself by doing something that is unrelated to XPCOM in every possible way.