> How does performance look for private ERC20-type contracts? zkSNARKS can be rather heavy to compute, so would that affect scalability?

For private contracts, the performance is not going to be good, so we recommend keeping private logic as minimal as possible. We looked into several different private computation models and SNARKs had the best performance characteristics, but they're still not great.

> Is it possible to do cross-contract calls without knowing the recipient's private state? How does one construct a proof for a new state without knowing the original state?

This isn't possible for private contracts, the use case here would be for "contract law" style contracts between bounded, known collections of individuals.