Alex,
Please have a look at this patch (it's an evolution of the one we've been looking at together). The basic gist is that (as you discovered) setting onreadystatechange from within an onreadystatechange() callback crashes certain versions of jscript.dll. I also discovered that setting it to null sometimes throws an exception. So I preserved the 'nullFunc' stuff, added the setTimeout() trick around onreadystatechange sets within the callback, and updated the comments to reflect these issues. All the tests now pass as well.
Issues: 1368, 1610
Patch by: ajr, jgw
Files affected:
M user/src/com/google/gwt/http/client/XMLHTTPRequest.java
M user/src/com/google/gwt/xml/client/impl/XMLParserImplIE6.java
M user/src/com/google/gwt/user/client/impl/HTTPRequestImpl.java
M user/src/com/google/gwt/user/client/impl/HTTPRequestImplIE6.java