After some investigation and testing, I came to realize that IE does not properly follow to the definition of "same origin" codified in RFC 6454 Section 5. In particular, IE considers two addresses with differing ports to be the same origin, provided they also use the same protocol and host. The RFC specifically states that the port should also be considered.
Microsoft does not properly comply with this RFC in all versions of IE, including IE10. Surprise, surprise. So, in IE10 and older, the behavior I observed is expected. In all other browsers, it is not.