I have here something, which is not quite the same what you asked, but it is the only workaround I know of.
There is a way to send data to the Scriptable script from the WebView:
Add a function to WebView.shouldAllowRequest that blocks all requests with a URL that starts with scriptable:// for example or something else. Now you can just use window.location.href from the WebView to “navigate” to a URL with your defined keyword at the start. As this request is blocked by Scriptable, the WebView stays on the current page, but the script in Scriptable got the data.
Together with the WebView.evaluateJavaScript function you now have a two way communication set up.
Of course you can make a wrapper around this to have a simpler API.
Edit: You need to use window.location.href, because Scriptable can’t intercept XMLHttpRequest. At least in my tests it haven’t caught these.