This is weird?
php is calling the template - it knows it's there - and doesn't parse the script.
I could be wrong, but the last time I saw something like this it involved MOD-Security at the server; and you appear to be the only one having problems with it.
Try this, and if it doesn't work - then it's going to take someone else to fix it - because I'm out of ideas. (But at least they will know what it's not).
###
Open:
/adm/xs2_head.php
Find:
$template->set_filenames(array('body' => ADM_TPL . 'xs2_header.tpl'));
Change: xs2_header.tpl to header.tpl
###
Rename: /templates/common/ACP/xs2_header.tpl to header.tpl
###
See what happens.