Major Description
The attached test case serializes an invalid XML 1.0 document that contains a character with value 0x04. See http://www.w3.org/TR/REC-xml/#NT-Char for the list of valid characters in an XML 1.0 document.
I've done some digging and it seems that XMLFormatter should check for this. In fast, there is already code for XML 1.1 that checks for these control characters since they need to be escaped in 1.1. It looks like we need to check for invalid characters when in the 1.0 mode. There is the XMLChar1_0::isXMLChar() function which can presumably be used.