(GRRR! Three times I've had to use IE6 today. That's three too many.)
Interesting. I hadn't looked at how the MT It! version was doing it - nice that that scheme worked for a while.
Background: back when IE6 first came out, it broke Blogger's context menu BlogThis! with a permission denied error. That turned out to be because scripts in the security context of an external file called from the registry (it was a script hosted on the Blogger server) were no longer allowed to access the calling page's location from external.menuArguments.document.location.href, but instead had to access external.menuArguments.location.href. Shame we didn't find out that an inline script in the registry could do the job, and could access either one, since we couldn't convince Ev to make the tiny change it needed and I now own the term blogthis on Google thanks to hosting some huge Windows installer programs to just save a tiny script file on your computer and make a registry entry pointing to it.
However, it looks like now you can't access external.menuArguments at all from a script inline in the registry, and MT's going to have to go the same "registry entry points to an external file" route, though thank Ghu this time I shouldn't have to host giant installers. The script can be saved on the user's server, and the registry entry pointed at it there, or saved on the local computer, whichever seems easier. The only change is that you have to get the URL from external.menuArguments.location.href, so it should work (well, it does work) to use something along the lines of
<script type="text/javascript">
e=external.menuArguments;
l=e.location.href;
d=e.document;
t=d.selection.createRange().text;
bmwin=window.open('http://www.example.com/mt/mt.cgi?is_bm=1&bm_show=category&__mode=view&_type=entry&link_title='+escape(d.title)+'&link_href='+escape(l)+'&text='+escape(t),'_blank','scrollbars=no,width=410,height=490,status=yes,resizable=yes,scrollbars=yes');
bmwin.focus();
</script>
either saved on your computer with the registry entry changed to C:\wherever\mtit.js or saved on your server with the registry entry being
http://www.example.com/mt/mtit.txt (note that it's not .js, because if it's served as application/x-javascript then IE won't interpret it as javascript, but if it's served as text/plain it will, and have I mentioned how much IE drives me crazy? Their security model must be based on giving a kitten a skein of yarn, and then trying to model the result.)
Edit note: if you are viewing this in IE6, the line starting bmwin= should all be one line, with a cute overflow:scroll style. Maybe IE7 will be out before too much longer.