Native client is a horribly bad idea on so many levels. Wiz-bang demos aren't enough to distract from the danger.

Now trojans have one huge, lovely target. Just change browser settings and boom, easy attack. This in combination with hiding everything from users (status bar, url bar, etc.) is super dangerous. It's activex all over again.

Do it in webgl or otherwise, leave native code execution outside the browser.