Er, just realized I was looking at the wrong context there.  While what I said holds in general for dealing with XPCOM interfaces, but the situation here is that our code is running in a chrome context and so there are no wrappers involved.  If I was accessing a content window exposed into chrome/system principal-space, there would be an XPCNativeWrapper to protect us from getting tricked by content having clobbered key properties.  See for more info https://developer.mozilla.org/en-US/docs/Mozilla/XPConnect/XPConnect_wrappers