These are both valid according to the w3c's algorithm for parsing their recognized subset of ISO8601:
--- excerpt from [http://dev.w3.org/html5/spec/common-microsyntaxes.html]:
A time consists of a specific time with no time-zone information, consisting of an hour, a minute, a second, and a fraction of a second.
A string is a valid time string representing an hour hour, a minute minute, and a second second if it consists of the following components in the given order:
1. Two digits, representing hour, in the range 0 ≤ hour ≤ 23
2. A U+003A COLON character (:)
3. Two digits, representing minute, in the range 0 ≤ minute ≤ 59
4. Optionally (required if second is non-zero):
1. A U+003A COLON character (:)
2. Two digits, representing the integer part of second, in the range 0 ≤ s ≤ 59
3. Optionally (required if second is not an integer):
1. A 002E FULL STOP character (.)
2. One, two, or three digits, representing the fractional part of second
--- end excerpt
4. -> 3. -> 2. says that length is not enforced and fractional part of the second need not be zero padded as is currently required.
I would even go as far as to suggest that anything beyond thousandths (0.000XXXXX...) should just be ignored and should NOT result in a parser error as is the current behavior in both the current versions of Firefox and Chrome. But that is above and beyond.
This also seems to contradict your own documentation located at [http://msdn.microsoft.com/en-us/library/windows/apps/ff743760(v=vs.94).aspx] where it states:
sss Milliseconds 00 to 999
making it seem as if you would accept a 2 digit value for milliseconds.
Thanks for your time -ck