-void enter_script(script_ctx_t *ctx, jsexcept_t *ei)
+HRESULT enter_script(script_ctx_t *ctx, named_item_t *item, jsexcept_t *ei)
 {
+    HRESULT hres;
+
     memset(ei, 0, sizeof(*ei));
+    if(item) {
+        if(!item->script_obj) {
+            hres = create_named_item_script_obj(ctx, item);
+            if(FAILED(hres)) return hres;
+        }

Can we have it in exec_source instead? If nothing else, it would simplify enter_script error handling.

diff --git a/dlls/jscript/jscript.h b/dlls/jscript/jscript.h
index 8297838..9492f3f 100644
--- a/dlls/jscript/jscript.h
+++ b/dlls/jscript/jscript.h
@@ -205,7 +205,9 @@ typedef HRESULT (*builtin_setter_t)(script_ctx_t*,jsdisp_t*,jsval_t);
 HRESULT builtin_set_const(script_ctx_t*,jsdisp_t*,jsval_t) DECLSPEC_HIDDEN;
 
 typedef struct named_item_t {
+    jsdisp_t *script_obj;
     IDispatch *disp;
+    unsigned ref;

Maybe ref counting would make sense in a separated patch?

     DWORD flags;
     LPWSTR name;
 
@@ -213,6 +215,7 @@ typedef struct named_item_t {
 } named_item_t;
 
 named_item_t *lookup_named_item(script_ctx_t*,const WCHAR*,unsigned) DECLSPEC_HIDDEN;
+void release_named_item(named_item_t*) DECLSPEC_HIDDEN;
 
 typedef struct {
     const WCHAR *name;
@@ -243,6 +246,7 @@ struct jsdisp_t {
     DWORD prop_cnt;
     dispex_prop_t *props;
     script_ctx_t *ctx;
+    named_item_t *named_item;

I'd rather avoid having it here. I think that we should almost always be getting it from bytecode. In some corner cases, jsexcept should be enough to fill the gap.

     jsdisp_t *prototype;
 
@@ -433,6 +437,7 @@ struct _script_ctx_t {
     DWORD last_match_length;
 
     jsdisp_t *global;
+    jsdisp_t *item_context;

Same here, do we really need it?

Thanks,

Jacek