Fixed in the next release.
While most immediately apparent for the feed's content, this actually occurs for any wiki script that relies on AJAX transmission, because of a race condition between base.js and a dependent class. For some reason this condition only affects some versions of Internet Explorer and Opera.
Anyway, this is fixed by using base.js's built-in init subscriber, which vb3/base.js and xf/base.js weren't subscribing to, as they should have been. This led to the user token used to authenticate POST requests to be empty during some AJAX requests.