I will add some more info for you:
If you end up reusing the object, the open method should come before onreadystatechange
I talk about it here:
If you are creating an object each time, it really does not matter what order they come in.
The standards say it should not matter, IE says otherwise!
With the status != 200 you should be using a try catch.
I talk about the error that can occur here:
There is another group of fun errors with status codes in th 12XXX. (IE errors)
I actually have code in my handlers that see this error and issue a retry attempt.
Good thing to do is look at Dojo, Prototype, and YUI on what they do under the covers. You will see notes on errors and other strange things. I have seen almost all of them in my logs at work. I log all clientside errors with a custom framework. Drives me insane with Object Expected and the boss expects you to know what the issue is with a line number!