The bug you have noted where <![CDATA[ is not handled correctly has been described by Brad Newberg here:

http://codinginparadise.org/weblog/2006/02/how-to-speed-up-flash-8s.html

Here is Brad’s explanation:
I found all of the JavaScript serialization methods in the Flash player (and they are in JavaScript) by using the Microsoft Debugger (they all live on window.parent; you’ll see them appear a few seconds after the Flash player loads). These methods handle all of the serialization and deserialization and all begin with the name __flash__. It turns out that they ARE using XML internally, and did not implement a real XML parser on the C++/Flash side which can correctly handle CDATA sections. They are also doing evals(), which is one of the reasons it is slow.