They basically run the scripts, instrumenting their Chakra JS engine to automatically abort overlong loops and overdeep recursion, and preventing all side effects outside of the DOM/JS runtime. And then use the actual types that occur in this run to do the completion. Plus, I guess, some added tricks that the talk doesn't go into, but which are necessary to make sure execution actually reaches the part of the program where you are trying to complete something.
I was able to create situations where it failed to find any type for a variable, and when you have variables that may contain multiple types it appears to only find one type, but I wasn't able to make it report any actually wrong types. (But I haven't used it very much.)
