A snapshot contains everything needed to fully initialize a new Isolate, including language constants (e.g., the undefined value), internal bytecode handlers used by the interpreter, built-in objects (e.g., String), and the functions installed on built-in objects (e.g., String.prototype.replace) together with their executable Code objects.
This sounds suspiciously like the Smalltalk image. The Smalltalk undefined value was involved in some paradoxes, therefore it couldn't be completely defined/instantiated declaratively.
I wonder if the (de)serialization mechanism used here could be re-targeted in a manner resembling the Parcel technology developed for VisualWorks Smalltalk? Basically, the runtime state of an application could be serialized into a "parcel," which could then be rapidly deserialized and more or less directly injected into the runtime image.