One
snippet of XSLT code I'm using as an example is:

<A NAME="linkone"><xsl:attribute
name="HREF">javascript:process('linkone',<xsl:value-of
select='/rootnode/value'/>)</xsl:attribute>Click me, value
is: <xsl:value-of select="/rootnode/value" />.</A>

(Notice the <xsl:value-of> tag inside the Javascript call
inside the A
HREF, and inside the A HREF data field.)

This is now well-formed (though not very pretty) XML, and it's correct XSLT.
The HTML it generates is slightly dubious, because javascript:process(.....)
is not a legal URL, so some HTML validators may get upset about it (and the
XSLT serializer will replace spaces by %20, which would probably stop it
working); you may be better off generating attributes like onClick that are
designed to hold Javascript rather than URLs.