I'm no expert on XPath and its semantics, but if somebody submits a bug report and preferrably a self-contained example, I can investigate things closer.

You may safely use the code I provided in the OP as example. I'm simply using Firebug+FirePath addons on the target Firefox, to get results from javascript only.

According to https://developer.mozilla.org/en-US/docs/XPCOM_Interface_Reference/nsIDOMXPathResult#Type_constants, I think the problem comes from the parameters given to the XPath evaluator, which limits the retrieved elements to nodesets. IMHO, the solution would be to use XPathResult.ANY_TYPE and perhaps a more elaborated function than identity to build the result set.

Should I open a bug on RT for this?