Implementing a cross-browser AJAX utility as an exercise
I can't specifically comment on your usage of the extra tries for &lt; IE7, as I always make sure my audience is using something better.  It seems like there should be a more elegant way to check each of those than a try with an empty catch, but without knowing how IE treats them, I can't say what it would be.  The rest is okay, but I would suggest the following.  My changes are explained in my own comments.

var ajax = {
  request: function(url, requestType, callback, queryString) {
    var ids = ['MSXML2.XMLHTTP.3.0',
    'MSXML2.XMLHTTP',
    'Microsoft.XMLHTTP'],
    xhr;

    // Simplification of this check while essentially doing the same thing
    if (window.XMLHttpRequest) {
      xhr = new XMLHttpRequest();
    } else {
      for (var i = 0; i &lt; ids.length; i++) {
        try {
          xhr = new ActiveXObject(ids[i]);
          break;
        } catch(e) {}
      }
    }
    // Calling a function to return a function is redundant.
    // Do what you're trying to with as little extra as possible.
    xhr.onreadystatechange = function() {
        callback(xhr);
      };
    xhr.open(requestType, url, true);
    if (requestType.toUpperCase() === 'GET') {
      // When initiating a get request, the send function needs no arguments at all.
      xhr.send();
    } else if (requestType.toUpperCase() === 'POST') {
      xhr.send(queryString);
    }
    // If you want to be extra careful, include an else here to handle a bad requestType
  }
}