I'm pretty sure what's happening is that when you install Office onto a Windows 7 computer it changes the XML icon path from a static path (see: HKEY_CLASSES_ROOT\xmlfile\DefaultIcon in the registry), to a "%1" variable.
In combination with the fact that the xmlfile entry also has a ShellEx\IconHandler key means that the icon is dynamically controlled by a DLL (or some other handler). If you look up the GUID in the IconHandler default value's data, you can figure out what program is being used to handle that icon.
Mine happens to be {AB968F1E-E20B-403A-9EB8-72EB0EB6797E}, so I searched the registry until I found HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{AB968F1E-E20B-403A-9EB8-72EB0EB6797E}\InprocServer32
Which lists "C:\Program Files (x86)\Common Files\Microsoft Shared\OFFICE12\MSOXEV.DLL" as the program handling it. So when an XML is queried, the MSOXEV.DLL is checked, which interrogates the file deeply, and determines which icon to display.
There's also an excellent explanation in an answer to a similar question over at StackOverflow if you want to go check that out as well.