Unfortunately I have vivid memories of one API I worked with (many years ago) that included entire encoded XML documents as attribute values within top level XML. At least there was only one level of recursion.
Still, perhaps not as bad as using XML documents as database keys...
Receiving XML that is almost valid can be a real pain - it certainly used to be that some XML parsers didn't report some weird errors in a particularly helpful way requiring manual scrutiny.
I have unpleasant memories of trying to work out why some SOAP web service was breaking and it turned out the WSDL was invalid in a subtle way.
I've needed to do that for HTML. If you need to put part of a document inside an iFrame (perhaps because you don't trust it) you have your backend generate <iframe sandbox srcdoc="..."> and nest it.
Still, perhaps not as bad as using XML documents as database keys...