dzieciou is right, generating usefully broken XML cases you need to separate feeding in plain oldbroken XML and XML which breaks your schema (the application.) The latter is probably the most useful, because it is hardest to guard against, and a test program that generates valid xml using all the known elements and attributes your application recognizes by randomizing their ordering, their parent/child and so on will probably generate plenty of test-data. I have found SAX or parsing-based apps break if you change the order that nodes appear in the file for example.
So having some knowledge of the approach the application under test uses is going to save you some time.