Just a brief update, Hassan Khan one of the lead developers of XSSDetect and part of our ACE Engineering team has posted up some technical details on how XSSDetect uses data flow analysis to do its magic.  You can read more about it here.  Feel free to leave additional questions and I'm sure he'll follow up with more details in another post soon!