Found it. Xerces is passing us an attributeDecl SAX event with valueDefault set to null rather than "" (which is correct by SAX's DeclHandler interface definition), but SerializerToXML wasn't expecting that value. Definite oops, fix checked in.
Note that this _ONLY_ affects the default identity transformation, since if you actually run through XSLT the internal subset is not part of the data model and is not preserved.
