I recently had to port my original simpler solution using --xpath to a platform lacking this feature, so had to adopt the "cat" solution too. This will handle multiple matches, tested on Ubuntu 12.04 and Solaris 11:
getxml() { # $1 = xml file, $2 = xpath expression
echo "cat $2" | xmllint --shell $1 |\
sed -n 's/[^\"]*\"\([^\"]*\)\"[^\"]*/\1/gp'
}
e.g. extracting instance names from a glassfish domain config:
$ getxml /tmp/test.xml "//server[@node-ref]/@name"
inst1
inst2
The sed post-processing just grabs all quoted values which was adequate for my needs (getting bits of glassfish config).