If you align everything to 8-byte boundaries (as you would if tagged doubles are your basic data structure) you can knock off the bottom three bits, fitting a 55-bit pointer into the mantissa. You can borrow two different NaNs to represent the high bit if you really need it.
But yes, the scaling limits are distinctly finite, which puts limit on the long-term viability of the techique.
You would have to guarantee that any light userdata follows the same rules. The C99 standard guarantees that an "intptr_t" or "uintptr_t" can be cast to a "void*" and back, so any code that relies on this would have to be rewritten, and Posix requires the same for function pointers. Interfacing with 3rd party libraries may also be affected, because that library may provide you with a pointer value you'd have to store that does not guarantee 8 byte alignment.
