In practice it's similar to the way NACL/pNACL can sandbox code due to the limited instruction set & validation guarantees.
Really? That doesn't match my experience -- the full Firefox test suite is run through ASAN on every check-in. (See the "Linux x64 ASAN" results at https://tbpl.mozilla.org/?tree=Mozilla-Inbound, for example).
So I'd be interested to know what you base this claim on.
I've talked to the person who implemented the LSAN support, and he says that the LSAN leaks being suppressed are not particularly large.
I also know a person who has recently been running the main test suite through Valgrind. (We do smoketests with Valgrind on every checkin, but not the full suite because it's too slow.) He found a few undefined value errors, which ASAN cannot detect, and which are getting fixed, but no UAFs as far as I know.
Now you have separate processes for each tab.
Still, considering that the underlying browsers are implemented in C++, I don't think anyone is under the impression that this is some kind of wonderful security feature.