We do in fact translate AS (AVM2) bytecode into JS source. We can't target JS bytecode because we would like Shumway to run on every browser, not just Firefox. Maintaining one JS VM is a lot easier than dealing with two. Although it is fairly tricky to emulate AS features in JS, it's significantly easier than rewriting / maintaining a VM like Tamarin.