@Luke,

Looks like "XP-home" and "XP-pro" are both recorded as "XP" within GA`s Operating System version field, in the drilldown report in GA :(

Regarding "browser history" hack (CVE-2012-0012) - It looks like this only effects IE9.
CVE-2012-0012: IE9 does not properly handle creation & initialization of string objects - allowing remote attackers to read data from arbitrary process-memory locations via a crafted web site (aka "Null-byte info disclosure vulnerability"): http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-0012

IE6-all-versions is not vunerable to "Copy and Paste Information Disclosure Vulnerability" CVE-2012-0010

IE6-xp-home is "moderately vunerable" to "HTML Layout Remote Code Execution Vulnerability". However, IE6-XP-pro is not vunerable to CVE-2012-0011 accorging to MS Vulnerability Severity Rating Chart. http://technet.microsoft.com/en-us/security/bulletin/ms12-010