> I gave up dirty hacks long ago  (and as you've said yourself,
> that was a dirty hack).

I wash my hacks in Persil.

Haven't worked out the detail, but it seems to me that if you add a trailing
comma at the end of the string, you can then do

<xsl:analyze-string select="concat($in, ',')" regex='("[^"]*"|[^,]*),'>
  <xsl:matching-substring>
    <token><xsl:value-of select="regex-group(1)"/></token>
  </xsl:matching-substring>
</xsl:analyze-string>

Doesn't strip the quotes off, but that part's easy.

--
http://andrewjwelch.com