To give an example of the flavor of issue: when building an array (even from a literal), you couldn't push a series of values to the stack and then construct an array out of them, because with E4X between elements 2 and 3 you might end up invoking arbitrary code with access to the array so that it establishes a setter on element 4 and adds a `valueOf` hook to what you're passing as element 5, but oh wait that's the same object you already inserted as element 0, and anyway the array might be frozen now and... (I'm making this up; I know the issues were similar to this but I probably don't have the details quite right.)
E4X was a rich, rich source of security bugs. I'm sure a simplified form of it is possible and would be quite cool, but that niche is already filled now with JSX for better or worse.