We upgraded from 1.7.2 to 1.8.2, and I was able to track down the offending javascript:

In version 1.7.2 we had this to test crossdomain:

crossDomain = !!( parts &&
	( parts[ 1 ] != ajaxLocParts[ 1 ] || parts[ 2 ] != ajaxLocParts[ 2 ] ||
		( parts[ 3 ] || ( parts[ 1 ] === "http:" ? 80 : 443 ) ) !=
			( ajaxLocParts[ 3 ] || ( ajaxLocParts[ 1 ] === "http:" ? 80 : 443 ) ) )

In version 1.8.2 we have this:

crossDomain = parts && ( parts.join(":") + ( parts[ 3 ] ? "" : parts[ 1 ] === "http:" ? 80 : 443 ) ) !==
	( ajaxLocParts.join(":") + ( ajaxLocParts[ 3 ] ? "" : ajaxLocParts[ 1 ] === "http:" ? 80 : 443 ) );

Notice how in 1.8.2 it also requires the [0] element of the array to be the same, this would not be the case for "http://www.slashdot.org" and "http://www.slashdot.org:80" for example.

A solution with minimal change would be this:

crossDomain = parts && ( parts.slice(1).join(":") + ( parts[ 3 ] ? "" : parts[ 1 ] === "http:" ? 80 : 443 ) ) !==
	( ajaxLocParts.slice(1).join(":") + ( ajaxLocParts[ 3 ] ? "" : ajaxLocParts[ 1 ] === "http:" ? 80 : 443 ) );