Since we are testing out-of-process access, I decided to fashion another server similar to Selenium Remote Control, Speclenium. Instead of communicating with Selenium Core, it speaks MSAA and as such provides the necessary foundation for accessibility testing.
The Selenium client has been subclassed to include accessibility-specific tests, like asserting the existence of certain accessible object nodes, and waiting for the expected accessibility-related events.