The following uses the readfile() function to load an XML file. This pattern can be used for AJAX calls outside of the security sandbox:

header('Content-type:text/xml');
/*
    WARNING:
    Do not include a Unicode Signature or
    Byte-order Mark (BOM) in this UTF8-encoded document.
    Doing so should generate "Cannot modify
    header information..." warnings in PHP.
*/
$uri = $_GET['uri'];
@readfile($uri);