The issue is that the code checks the current HTTP protocol for the page, whether it is served as SSL or not.  If it is, the tracking code is served from a secure server to prevent your browser from complaining.  The actual tracking code is loaded using a script that uses a document.write() operation to add the script tag to your page.  This is illegal on pages served as XML, because the browser (at least Firefox) is designed to restrict JavaScript from inserting markup during render time.

This probably affects only the “latest” tracking code, ga.js, and not the legacy code, urchin.js.

The fix is actually pretty easy, despite the fact that I couldn’t find any official documentation about it from Google.  Take a look at the legacy code for inserting urchin.js on your page.  It uses a normal script tag, instead of using document.write() to insert the tag — which is legal.

Now look at the JS code used to insert ga.js.  Assuming you’re not serving an SSL site, you can replace the document.write() with a static script tag.  Something like the one below:

<script src="http://www.google-analytics.com/ga.js" type="text/javascript"></script>

If you are using SSL on your site, along with the application/xhtml+xml mime-type, then it’s up to you to deal with switching the hostname and protocol in the URL in the appropriate pages.

You should not make this change to the tracking code unless you need to (i.e. you’re serving XHTML and tracking pixels are not firing properly).