With liorean's help, we debugged this particular issue - instead of using the reference to the object, using the object property
of the object returns a #document node:
var doc = obj.object;
But it still doesn't work, because I was using cloneNode instead of importNode - the ownerDocument of the cloned node is the <object> document, so it can't be appended to the outer document, because of the cross-document security restriction. Since importNode isn't supported in win/ie, outerHTML remains the only solution (or using an iframe instead of an object)
Sorry this is all a bit OT though ...