Is there a security limit to the number of Ajax XMLHttpRequest objects you can create on a single page? If so, does this vary from one browser to another?
I don't think so, but there's a limit of two simultaneous HTTP connections per domain per client (you can override this in Firefox, but practically no one does so).
Yes, as Kevin says, HTTP/1.1 specifications say "A single-user client should not maintain more than 2 connections with any server or proxy."
I've found it easier to pool and reuse XMLHTTPRequest objects instead of creating new ones...