This kind of stuff is awesome. I made a profiler for ObjC that did a similar thing, but by programmatically creating a new subclass and only profiling certain instances.
On your prevent instrumentation proxy methods; if the original method references ivars without using self.x or [self x] do you notice weird results?