So the key part seems to be that we make the CheckQName call in nsDocument::CreateElement and pass it aTagName, which contains the single char U+10BD GEORGIAN CAPITAL LETTER CHAR. Then we lowercase the string and call CreateElem with the result. After lowercasing, the string contains a single U+2D1D GEORGIAN SMALL LETTER CHAR. This is passed to MOZ_XMLCheckQName which operates on _bytes_. It examines the first byte, which is decides is of type NONASCII (which it is!) and then nmstart is true but IS_NMSTRT_CHAR_MINBPC is false so it errors out. Peter, are some of expat's tables off here?
You need to log in before you can comment on or make changes to this bug.