I would guess it's a configuration error around something like smart extensions, maybe? "If the clean URL has a .xml at the end, send the request through PHP."

Dumb, but it's the only thing I can come up with offhand.