This question kept nagging at me. I took another look and found the following parameter that can be passed to your XML::Parser constructor:

my $p = XML::Parser->new(
  ParseParamEnt => 0,
);
[download]

Also it comes in handy to do your own error handling when dealing with crufty XML -- otherwise the parser will fatally croak:

my $p = XML::Parser->new(
  ErrorContext  => 2,
  ParseParamEnt => 0,
);
[download]

FYI, ParseParamEnt appears to only apply to Expat under the hood.

Cheers,
Matt