And then that'll fail for comments that span lines. But you can tweak that by slurping the entire file in, but then someone else will find another corner case that breaks that . . .

If you're parsing XML, use a proper parser. Unless you can guarantee a very specific input format any attempt using solely regexen is going to have problems. It's not like there aren't 19 bazillion different off-the-shelf XML parsing solutions available out there which will handle all the nastiness for you.

Update: And no, saying there's another corner case is not "FUD".

<?xml version="1.0"?>
<root><![CDATA[ <!-- OMGWTFBBQ --> ]]></root>
[download]

Update: Or to make the breakage more explicit:

<?xml version="1.0"?>
<root><![CDATA[ <!-- OMGWTFBBQ ]]>Shoulda used a <!-- real parser --><
+/root>
[download]