XMLHttpRequest returning with status 200, but 'onreadystatechange' event not fired

Question

We have been receiving an intermittent bug with the XMLHttpRequest object when using IE11. Our codebase is using legacy architecture, so this browser is required.

After clicking a button, the browser launches an out-of-band process by creating a new ActiveX control which integrates with a camera to capture an image. This control appears to be working fine... it allows the operator to capture the image, and the Base64 content of the image is returned out of the control back to the browser interface, so I think we can rule out a problem with this object.

Once the image is returned to the browser, the browser performs an asynchronous 'ping' to the web server to check if the IIS session is still alive or it has expired (because the out-of-band image capture process forbids control of the browser while it is open).

The ping to the server returns successfully (and running Fiddler I can see that the response has status 200), with the expected response data:

<sessionstate>ok</sessionstate>

There is a defined 'onreadystatechange' function which should be fired on this response, and the majority of times this seems to fire correctly. However, on the rare occasion it does appear, it continues to happen every time.

Here is a snippet of the code... we expect the 'callback()' function to be called on a successful response to Timeout.asp:

    XMLPoster.prototype.checkSessionAliveAsync = function(callback) {
        var checkSessionAlive = new XMLHttpRequest();

        checkSessionAlive.open("POST", "Timeout.asp?Action=ping", true);
        checkSessionAlive.setRequestHeader("Content-Type", "application/x-www-form-urlencoded");
        checkSessionAlive.onreadystatechange = function() {
            if (checkSessionAlive.readyState == 4) {
                if (checkSessionAlive.responseText.indexOf("expired") != -1 || checkSessionAlive.status !== 200) {
                    eTop.window.main.location = "timeout.asp";
                    return;
                }

                callback(checkSessionAlive.responseText);
            }
        }

        checkSessionAlive.send();
    }

Has anyone seen anything like this before? I appreciate that using legacy software is not ideal, but we are currently limited to using it.