+1  A: 

It seems unlikely that it's the AJAX request removing the cookie (which would be a browser bug) and more likely that YouTube is revoking the session (which is identified by the cookie) by removing the cookie. I notice the two requests are different - does this work

document.location = "/get_video?video_id=" + yt.getConfig('SWF_ARGS')['video_id'] + "&t=" + (unescape(yt.getConfig('SWF_ARGS')['t'])) + "&fmt=37"

Also try only testing for two different formats - YouTube might think you're trying to brute force, or just not allow attempted API mashups by revoking cookies from request over XMLhttp...

Andy
Yeah I've figured it out now. I was mistaking the actual XMLHttpRequest for the document.location request, which explains why the cookies weren't present. The document.location = url + formats[i]; line is never executed because the request just hangs.
Joe B
This is a useful proxy for debugging stuff that firebug doesn't tell you http://www.fiddler2.com/fiddler2/
Andy
You can also use WireShark for things like this. I'm trying to now, but unfortunately the server I'm working against is HTTPS only, so I only see encrypted traffic :(
Drew Noakes