I think the new 'toggle' functionailty for pins works by writing a 1 to it's PIN register.
e.g. to toggle bit 3 of port B, you can do:
PINB = B1000 ;
[yup - M88 datasheet, section 13.1 : "writing a logic one to a bit in the PINx Register, will result in a toggle in the corresponding bit in the Data Register"]
This does NOT work on Mega8's.
I think this means a 3 cycle loop is possible (1 cycle for the OUT instruction, 2 cycles for the RJMP).
That results in a 2.666Mhz square signal.
In theory you can beat this by filling the memory space with that OUT instruction, and letting the program-counter roll-over at the end of flash, but there are problems with this solution, despite a theoretical 8Mhz output...