object and embed HTML elements are host objects.
ECMAScript3 11.4.3 didn't define what typeof should return for these. The table of returned values for Objects was
- Object (native and doesn't implement [[Call]]): "object"
- Object (native and implements [[Call]]): "function"
- Object (host): Implementation-dependent
However, returning "function" is consistent with ECMAScript5 11.4.3:
- Object (native and does not implement [[Call]]): "object"
- Object (native or host and does implement [[Call]]): "function"
- Object (host and does not implement [[Call]]):  Implementation-defined except may not be "undefined","boolean","number", or"string".
object and embed HTML elements are objects with an internal [[Call]] property, so typeof must return "function".
This is explained in Bug 268945:
- Comment #15, by Boris Zbarsky: - 
- The [[Call]] is very intentional on the DOM side: these are callable objects. 
 
- Comment #16, by Tom Schuster: - 
- This bug is invalid these object have a [[Call]] internal method and
  ES5 11.4.3 explicitly say "Object (native or _host_ and does implement
  [[Call]])" => "function". 
 
Since object and embed HTML elements implement an internal [[Call]] property, they are callable objects. However, they are not functions:
4.3.24 function
member of the Object type that is an instance of the standard built-in
  Function constructor and that may be invoked as a subroutine
object HTML elements inherit from HTMLObjectElement.prototype, and embed HTML elements from HTMLEmbedElement.prototype.
The prototype chain continues with
- HTMLObjectElement.prototype
- HTMLElement.prototype
- Element.prototype
- Node.prototype
- Object.prototype
Therefore, they are not Function instances, because they don't inherit from Function.prototype.