It's been a long time since I did any AJAX, and I never got as deeply into it as I might have wanted, but my recollection is that the pattern was that the variable containing the XMLHttpRequest object is global. You have yours inside the function. Bear in mind that you still have a big issue with multiple requests using a global -- I wrote a couple of blog posts about that years ago. Take a look at the code in the comment by John Wehr on the post linked below. His is a much better solution than mine. There's also a comment by JaGx which refers to what I think is really the preferred way, using a local variable in an anonymous function -- but I'm a little too out of touch with it right now to say for sure.
Here's the blog post: http://www.poweroftheschwartz.com/web/blog/poweroftheschwartz.nsf/d6plinks/RSCZ-6CDPEX