Note: Support for remote XUL has long been a potential security concern; support for it was disabled in Gecko 2.0. This also means you can't load XUL using file:// URLs unless you set the preference dom.allow_XUL_XBL_for_file to true. However, there is a whitelist that lets you specify sites that can still use remote XUL. The Remote XUL Manager extension lets you manage this whitelist, which is maintained using nsIPermissionManager, by creating entries of type "allowXULXBL", like this:

Components.classes["@mozilla.org/permissionmanager;1"]
                    .getService(Components.interfaces.nsIPermissionManager)
                    .add(uri, 'allowXULXBL', Components.interfaces.nsIPermissionManager.ALLOW_ACTION);