> That's not how entities work - whoever designed this XML has got it
> very wrong...

what's wrong with it!!! It's _exactly_ how NDATA entities work.

Oh dear, I got it very wrong, sorry. unparsed-entity-uri() is
completely new to me (with 7 years ish of xslt now....)

As far as i can see the XSLT

<img src="{unparsed-entity-uri(@ID}}"/>

would do the right thing here.

Yes, reading around briefly it seems that's how it works, although it
looks like a really bad idea. Surely a legacy thing? (or is it widely
used and I'm just blinkered?)