This is not entirely surprising, since that file is dated 31 Jan 98,
and the XML draft current at that time specified the declaration above!
IE 5 appears to be within its rights not to detect the error (in the
declaration, not the use, of the entity). Section 4.6 says that amp
"must" be declared as "&", and violation of "must" is an "error"
which "may" be detected.
-- Richard