It seems to me you should use
var http = new window.ActiveXObject("Microsoft.XMLHTTP");
or just
var http = new ActiveXObject("Microsoft.XMLHTTP");
inside of .hta file instead of CreateObject()
.
UPDATED: Hi Luca! I have not much place in comments and can post links not so good, so I appended my answer:
The error which you do from the code of your question is that you try use in JavaScript elements of other language. In VBScript exist CreateObject, but it is a feature of the VBScript language. In JScript/JavaScript you have to use new ActiveXObject instead.
Moreover you mentioned in your comments several times about cross domain problems, but never described what do you do. If you want a help about this subject you should include in your question more information about what do you do. Probably you can include code in WSH or C which worked and include the corresponding version of the .HTA file. It would be also helpful if you describes why you want to use .HTA file instead of WScript/CScript or PowerShell. In which scenario you want to use .HTA file?