Documentation 
Section: libxml-xpath
Returns: the string value of the object, NULL in case of error. A new string is allocated only if needed (@val isn't a string object). 

Correct version:
Returns: the allocated string value of the object, NULL in case of error.
It's up to the caller to free the string memory with xmlFree().


Other information:
If we look at source code, we can see:
...
case XPATH_STRING:
     return(xmlStrdup(val->stringval));
...

So, xmlStrdup() will be called in any case, even when @val is string object.