Have you seen this link? The replier suggests:
The problem is due to the fact that the xml is launched from the user’s local cache, which is NOT a trusted site, thus making the contact selector un-usable.
I don't know if that is the case in your scenario, but might be something worth investigating?