Note: that TypeOfString was only ever used to fold constant HTypeOfIsAndBranch instructions and was never used to constant fold standalone typeof Const which did not participate in typeof x == “…” like pattern. That’s why things like (0, typeof null) == ‘undefined’ work around this bug — because they break recognition of this pattern.
Regarding let vs var. If you bump iteration limit for the `var` case to 20000 you will see it hit the bug. The reason for this is that for loop with `let`-binding gets desugared in a very baroque way in V8 — which causes it to be optimized earlier than for loop with `var`-binding.