diff --git a/dlls/jscript/compile.c b/dlls/jscript/compile.c
index 00874592880..d894b9824d8 100644
--- a/dlls/jscript/compile.c
+++ b/dlls/jscript/compile.c
@@ -408,6 +408,32 @@ static inline BOOL is_memberid_expr(expression_type_t type)
     return type == EXPR_IDENT || type == EXPR_MEMBER || type == EXPR_ARRAY;
 }
 
+static BOOL bind_local(compiler_ctx_t *ctx, const WCHAR *identifier, int *ret_ref)
+{
+    statement_ctx_t *iter;
+    local_ref_t *ref;
+
+    for(iter = ctx->stat_ctx; iter; iter = iter->next) {
+        if(iter->using_scope)
+            return FALSE;
+    }
+
+    ref = lookup_local(ctx->func, identifier);
+    if(!ref)
+        return FALSE;
+
+    *ret_ref = ref->ref;
+    return TRUE;
+}
+
+static HRESULT emit_identifier_ref(compiler_ctx_t *ctx, const WCHAR *identifier, unsigned flags)
+{
+    int local_ref;
+    if(bind_local(ctx, identifier, &local_ref))
+        return push_instr_int(ctx, OP_local_ref, local_ref);
+    return push_instr_bstr_uint(ctx, OP_identid, identifier, flags);
+}
+
 static HRESULT compile_memberid_expression(compiler_ctx_t *ctx, expression_t *expr, unsigned flags)
 {
     HRESULT hres = S_OK;
@@ -416,7 +442,7 @@ static HRESULT compile_memberid_expression(compiler_ctx_t *ctx, expression_t *ex
     case EXPR_IDENT: {
         identifier_expression_t *ident_expr = (identifier_expression_t*)expr;
 
-        hres = push_instr_bstr_uint(ctx, OP_identid, ident_expr->identifier, flags);
+        hres = emit_identifier_ref(ctx, ident_expr->identifier, flags);
         break;
     }
     case EXPR_ARRAY: {
@@ -1095,7 +1121,7 @@ static HRESULT compile_variable_list(compiler_ctx_t *ctx, variable_declaration_t
         if(!iter->expr)
             continue;
 
-        hres = push_instr_bstr_uint(ctx, OP_identid, iter->identifier, 0);
+        hres = emit_identifier_ref(ctx, iter->identifier, 0);
         if(FAILED(hres))
             return hres;
 
@@ -1304,7 +1330,7 @@ static HRESULT compile_forin_statement(compiler_ctx_t *ctx, forin_statement_t *s
         return hres;
 
     if(stat->variable) {
-        hres = push_instr_bstr_uint(ctx, OP_identid, stat->variable->identifier, fdexNameEnsure);
+        hres = emit_identifier_ref(ctx, stat->variable->identifier, fdexNameEnsure);
         if(FAILED(hres))
             return hres;
     }else if(is_memberid_expr(stat->expr->type)) {
diff --git a/dlls/jscript/engine.c b/dlls/jscript/engine.c
index 642705a35ce..2f74d8a84af 100644
--- a/dlls/jscript/engine.c
+++ b/dlls/jscript/engine.c
@@ -175,6 +175,18 @@ static inline HRESULT stack_pop_uint(script_ctx_t *ctx, DWORD *r)
     return to_uint32(ctx, stack_pop(ctx), r);
 }
 
+static inline unsigned local_off(call_frame_t *frame, int ref)
+{
+    return ref < 0
+        ? frame->arguments_off - ref-1
+        : frame->variables_off + ref;
+}
+
+static inline BSTR local_name(call_frame_t *frame, int ref)
+{
+    return ref < 0 ? frame->function->params[-ref-1] : frame->function->variables[ref].name;
+}
+
 /* Steals input reference even on failure. */
 static HRESULT stack_push_exprval(script_ctx_t *ctx, exprval_t *val)
 {
@@ -546,13 +558,6 @@ static HRESULT equal2_values(jsval_t lval, jsval_t rval, BOOL *ret)
     return S_OK;
 }
 
-static inline unsigned local_off(call_frame_t *frame, int ref)
-{
-    return ref < 0
-        ? frame->arguments_off - ref-1
-        : frame->variables_off + ref;
-}
-
 /*
  * Transfers local variables from stack to variable object.
  * It's slow, so we want to avoid it as much as possible.
@@ -1192,6 +1197,51 @@ static HRESULT interp_this(script_ctx_t *ctx)
     return stack_push(ctx, jsval_disp(frame->this_obj));
 }
 
+static HRESULT interp_identifier_ref(script_ctx_t *ctx, BSTR identifier, unsigned flags)
+{
+    exprval_t exprval;
+    HRESULT hres;
+
+    hres = identifier_eval(ctx, identifier, &exprval);
+    if(FAILED(hres))
+        return hres;
+
+    if(exprval.type == EXPRVAL_INVALID && (flags & fdexNameEnsure)) {
+        DISPID id;
+
+        hres = jsdisp_get_id(ctx->global, identifier, fdexNameEnsure, &id);
+        if(FAILED(hres))
+            return hres;
+
+        exprval_set_disp_ref(&exprval, to_disp(ctx->global), id);
+    }
+
+    if(exprval.type == EXPRVAL_JSVAL || exprval.type == EXPRVAL_INVALID) {
+        WARN("invalid ref\n");
+        exprval_release(&exprval);
+        exprval_set_exception(&exprval, JS_E_OBJECT_EXPECTED);
+    }
+
+    return stack_push_exprval(ctx, &exprval);
+}
+
+static HRESULT interp_local_ref(script_ctx_t *ctx)
+{
+    const int arg = get_op_int(ctx, 0);
+    const unsigned flags = get_op_uint(ctx, 1);
+    call_frame_t *frame = ctx->call_ctx;
+    exprval_t ref;
+
+    TRACE("%d\n", arg);
+
+    if(!frame->base_scope || !frame->base_scope->frame)
+        return interp_identifier_ref(ctx, local_name(frame, arg), flags);
+
+    ref.type = EXPRVAL_STACK_REF;
+    ref.u.off = local_off(frame, arg);
+    return stack_push_exprval(ctx, &ref);
+}
+
 /* ECMA-262 3rd Edition    10.1.4 */
 static HRESULT interp_ident(script_ctx_t *ctx)
 {
@@ -1221,32 +1271,10 @@ static HRESULT interp_identid(script_ctx_t *ctx)
 {
     const BSTR arg = get_op_bstr(ctx, 0);
     const unsigned flags = get_op_uint(ctx, 1);
-    exprval_t exprval;
-    HRESULT hres;
 
     TRACE("%s %x\n", debugstr_w(arg), flags);
 
-    hres = identifier_eval(ctx, arg, &exprval);
-    if(FAILED(hres))
-        return hres;
-
-    if(exprval.type == EXPRVAL_INVALID && (flags & fdexNameEnsure)) {
-        DISPID id;
-
-        hres = jsdisp_get_id(ctx->global, arg, fdexNameEnsure, &id);
-        if(FAILED(hres))
-            return hres;
-
-        exprval_set_disp_ref(&exprval, to_disp(ctx->global), id);
-    }
-
-    if(exprval.type == EXPRVAL_JSVAL || exprval.type == EXPRVAL_INVALID) {
-        WARN("invalid ref\n");
-        exprval_release(&exprval);
-        exprval_set_exception(&exprval, JS_E_OBJECT_EXPECTED);
-    }
-
-    return stack_push_exprval(ctx, &exprval);
+    return interp_identifier_ref(ctx, arg, flags);
 }
 
 /* ECMA-262 3rd Edition    7.8.1 */
diff --git a/dlls/jscript/engine.h b/dlls/jscript/engine.h
index b18b7750c37..f515bef3b58 100644
--- a/dlls/jscript/engine.h
+++ b/dlls/jscript/engine.h
@@ -48,6 +48,7 @@
     X(int,        1, ARG_INT,    0)        \
     X(jmp,        0, ARG_ADDR,   0)        \
     X(jmp_z,      0, ARG_ADDR,   0)        \
+    X(local_ref,  1, ARG_INT,    ARG_UINT) \
     X(lshift,     1, 0,0)                  \
     X(lt,         1, 0,0)                  \
     X(lteq,       1, 0,0)                  \