Ericlaw has a nice write up about the history of the XSS filter. Unfortunately it doesn’t help me fix my ongoing woes (which I’m nearly convinced must be a false-positive), but it does give a few insights and context to the feature.