inconsistent behavior of document() in browser vs. XSLTProcessor()

Hi,

    when I do the implicit transformation in the browser (xml +
xml-stylesheet PI) everything is just fine.
 When I do the transformation explicitly using XSLTProcessor(), I get
the Security Error messages in the console, and the output of the
transformation differs from the implicit one.
    I run XSLTProcessor() in xul chrome. The xml and xslt use file://
protocol. I turned the same-origin policy off.
    I tried to localize the source of the message, it seams to be the
document() function (I do document('')/*).
    Message looks like this:
Security Error: Content at
moz-nullprincipal:{4f66382f-93b9-49da-b835-4314d01e828a} may not load
data from file:///C:/home/maros/work2/dforms/projects/renderKit/code/src/renderKit/editors/choice.xsl.

   Any idea how to set XSLTProcessor to work as the one in the browser?

Thank you.

Maros.