HTTP response splitting attacks work when user data (including newlines) can be injected into HTTP headers.
For example, let's take this response:
HTTP/1.1 200 OK
Date: Mon, 23 May 2005 22:38:34 GMT
Server: Apache/1.3.3.7 (Unix) (Red-Hat/Linux)
Last-Modified: Wed, 09 Jan 2013 23:11:55 GMT
Accept-Ranges: none
Content-Length: 1234
Connection: close
Content-Type: text/html; charset=UTF-8
Cookie: test=123&username=Polynomial
<html>
...
Now let's assume I can change my username arbitrarily, and include CRLF (newlines) in the field. I could then inject my own content into the page.
For example, I might set my username to Polynomial\r\n\r\n<script>alert(document.cookie)</script>
, which would result in the following HTTP response:
HTTP/1.1 200 OK
Date: Mon, 23 May 2005 22:38:34 GMT
Server: Apache/1.3.3.7 (Unix) (Red-Hat/Linux)
Last-Modified: Wed, 09 Jan 2013 23:11:55 GMT
Accept-Ranges: none
Content-Length: 1234
Connection: close
Content-Type: text/html; charset=UTF-8
Cookie: test=123&username=Polynomial
<script>alert(document.cookie)</script>
<html>
...
As you can see, the JavaScript was injected into the page. This is a form of XSS / DOM injection via the splitting attack.
Including user data in a request isn't quite as bad, since the server should treat user requests as untrusted anyway. As such, AJAX requests shouldn't be an issue. This becomes even less of a problem when you consider the fact that most major browsers have disabled or limited the javascript:
handler in the URL bar, in order to limit the potential for attacks.