The whole problem comes down to the browser wanting to convert the response of an XHR into a unicode string and thus it chokes on the first 0x00 or other odd bytes that it sees. By forcing the character set and mapping around the nasty range values, this guy found a way to grab binary data.

The implications of this are extraordinary! JavaScript normally cannot read the image data of a picture. Thus CAPTCHA was an acceptable way to stop web viruses like Samy or Yamanner.

Hmmmm... Captcha busting in JavaScript? [Evil Laugh]

Downloading Binary Streams with XMLHttpRequest