Alex Robinson already (and first) gives the correct answer to this issue. But to elaborate it a little more...
You must add the HTTP response header:
Access-Control-Allow-Origin: *
If you do this, the result is not just 'might work', but 'will work'.
NB What you need to add is an HTTP response header - so you can only do this on a server which you control. It will never be possible to directly fetch http://w3schools.com/XML/cd_catalog.xml from its original URL using an XMLHttpRequest
(as per OP's question), because that resource does not (at least, not as of 24 Apr 2015) include any such CORS header.
http://en.wikipedia.org/wiki/Cross-origin_resource_sharing gives more info.