Just guessing, since I have not actually used either SQLXMLBulkLoad or Merge Replication, but....
Since Merge Replication depends on triggers to log changes, could the trigger somehow be bypassed. Is the .CheckConstraints property on the SQLXMLBulkUpload set to False?