Thanks Steffen G. We have also hit this problem with one of our OpenLayers clients and initially thought it was a bug in our code.
Your link to that OpenLayers example helped us prove otherwise.
Stepping through the OpenLayers source, the XML is built by native code in the XMLSerializer class. So I suspect this is a bug in IE11, not OpenLayers.
We have put in a workaround for this problem.
We override the write method in the OpenLayers.Format.XML class. After the XML has been generated we do a search-replace on the rogue text in the XML namespace.
Here is the code we run after OpenLayers has loaded:
var _class = OpenLayers.Format.XML;
var originalWriteFunction = _class.prototype.write;
var patchedWriteFunction = function()
var child = originalWriteFunction.apply( this, arguments );
// NOTE: Remove the rogue namespaces as one block of text.
// The second fragment "NS1:" is too small on its own and could cause valid text (in, say, ogc:Literal elements) to be erroneously removed.
child = child.replace( new RegExp( 'xmlns:NS1="" NS1:', 'g' ), '' );
_class.prototype.write = patchedWriteFunction;