++1 for HtmlUnit. I'm now writing selenium tests for a GWT app that I'll "play" on various browsers to verify correctness, but I'll run them on HtmlUnit as part of the post-build regression tests.
Jaxer is server side javascript, with access to a DOM. When I looked at it (more than a year ago now), they accomplished that via a headless firefox 3. I'd guess they still do that, since it worked for them.
Also, I'm not sure how they do it, but Jaxer (http://www.jaxer.org/) has a headless firefox instance they use. Maybe do it in a similar manner?