I'll speculate. They add extra lines (most probably via AST, not lines of chars) to the code which register if code run. Can't confirm that with code or anything. I saw similar techniqies in test coverage tools.
_cover(123);
Could be a fun project to write a bookmarklet that does this to the current page, then lets you use it and then tells you which parts of the code have not been used.