Given: <c:out value="< > , \" &" escapeXml="${null}"/> The output in this case is not escaped. According to section 2.7 of the JSTL 1.0 public draft, if an attribute can accept dynamic values and has a fixed set of acceptable values, and the value passed is null, then the default value should be used.
I believe that section 2.7 is being modified to apply only to String values. In this case, the RI coerces "null" to "false" per section A.7.4: 'escapeXml' is a boolean attribute. Since I'm pretty sure that this spec modification will go through, let's mark this closed for now and revisit it only if it doesn't get addressed.