FULL PRODUCT VERSION :
java version "1.6.0_01"
Java(TM) SE Runtime Environment (build 1.6.0_01-b06)
Java HotSpot(TM) Client VM (build 1.6.0_01-b06, mixed mode, sharing)


ADDITIONAL OS VERSION INFORMATION :
Microsoft Windows [Version 6.0.6000]

A DESCRIPTION OF THE PROBLEM :
Parsing the following file:
<?xml version="1.0"?>
<input onchange="#{component.attributes['onchange']}"
accesskey="#{component.attributes['accesskey']}"
size="#{component.attributes['inputSize']}"
style="#{component.attributes['inputStyle']}"
class="#{component.attributes['inputClass']}"
onselect="#{component.attributes['onselect']}"
onfocus="#{component.attributes['onfocus']}" onblur="#{component.attributes['onblur']}"/>

with the default parser returns onfocus attribute value as "#{component.attributes['onblur']}}"

STEPS TO FOLLOW TO REPRODUCE THE PROBLEM :
Save xml as test.jspx and run test code

EXPECTED VERSUS ACTUAL BEHAVIOR :
EXPECTED -
onfocus="#{component.attributes['onfocus']}"
is printed to the console
ACTUAL -
onfocus="#{component.attributes['onblur']}}"
is printed

REPRODUCIBILITY :
This bug can be reproduced always.

---------- BEGIN SOURCE ----------
Document document = DocumentBuilderFactory.newInstance().newDocumentBuilder().parse(this.getClass().getResourceAsStream("test.jspx"));
System.out.println(document.getDocumentElement()./*getChildNodes().item(1).*/getAttributes().getNamedItem("onfocus"));

---------- END SOURCE ----------

CUSTOMER SUBMITTED WORKAROUND :
The problem seems to be in com.sun.org.apache.xerces.internal.impl.XMLScanner class, in getStringBuffer() method.

There is the code there now:
            XMLStringBuffer tmpObj = new XMLStringBuffer();
            stringBufferCache.add(fStringBufferIndex, tmpObj);
            return tmpObj;

However I believe, the correct code should contain increment for fStringBufferIndex field:
            XMLStringBuffer tmpObj = new XMLStringBuffer();
            stringBufferCache.add(fStringBufferIndex, tmpObj);
            fStringBufferIndex++l
            return tmpObj;

Manually incrementing the field in debugger solved the problem