It might not send it automatically (I don't know, I haven't tested it), but since you're the one building the XHR, you can send the header if you want. The same origin policy won't let you see the results of a cross-domain request, so it seems like requiring the header is an effective technique.

Obviously this is only true for read operations: anything that updates state would still be vulnerable to CSRF (since you don't need to be able to read the result to make the request).