Ok, here we go..
Hopefully the line breaks make the trip.
Elliott Sprehn (http://www.elliottsprehn.com/) gets credit for the
clearHeaderBuffer function.
David Boyer (http://misterdai.wordpress.com/) gets original credit for
getHeaderBuffer though I modified it to work on ColdFusion 8.
Like I said, the Model Glue abstract remoting service has a Railo and BD
version of clearHeaderBuffer, but to my knowledge no one has ever done a
Railo or BD version of getHeaderBuffer.
Since Java Reflection is required for these to work, it's probably worth
petitioning Railo and BD to provide a public method in their page
context object to make it a little bit less messy. Heck, could ask
Adobe for it too, but the chances there are a little lower. 
To see these methods in action, use the following code:
Hello World
<cfajaxproxy cfc="proxy.pxMyProxy" jsclassname="pxMyProxy" />
<cfhtmlhead text="foobar">
#getCFHtmlHead()#
#resetCFHtmlHead()#
You will see that the JavaScript generated by CFAjaxProxy is outputted
below the Hello World text and that the foobar bit is outputted directly
below that. Normally the header content would have been in that order,
but ABOVE the Hello World text.
~Brad
P.S.
I haven't tested CF6 and getPageContext didn't exist in CF5 or previous.
(Do we care?)
<cffunction name="clearHeaderBuffer" output="false" returntype="void">
<cfscript>
var local = StructNew();
local.out = getPageContext().getOut();
while (getMetaData(local.out).getName() Is
'coldfusion.runtime.NeoBodyContent') {
local.out = local.out.getEnclosingWriter();
}
local.method =
local.out.getClass().getDeclaredMethod('initHeaderBuffer', ArrayNew(1));
local.method.setAccessible(true);
local.method.invoke(local.out, ArrayNew(1));
</cfscript>
</cffunction>
<cffunction name="getHeaderBuffer" output="false" returntype="any">
<cfscript>
var local = StructNew();
local.out = getPageContext().getOut();
while (getMetaData(local.out).getName() Is
'coldfusion.runtime.NeoBodyContent') {
local.out = local.out.getEnclosingWriter();
}
if(listFirst(server.coldfusion.productVersion) LTE 7)
{
local.field = local.out.getClass().getDeclaredField("headerBuffer");
local.field.setAccessible(true);
local.buffer = local.field.get(local.out);
return
iif(StructKeyExists(local,'buffer'),"local.buffer.toString()",de(""));
}
else // CF8 intruduced new header Buffer
{
local.field =
local.out.getClass().getDeclaredField("prependHeaderBuffer");
local.field.setAccessible(true);
local.buffer = local.field.get(local.out);
local.output =
iif(StructKeyExists(local,'buffer'),"local.buffer.toString()",de(""));
local.field =
local.out.getClass().getDeclaredField("appendHeaderBuffer");
local.field.setAccessible(true);
local.buffer = local.field.get(local.out);
return local.output &
iif(StructKeyExists(local,'buffer'),"local.buffer.toString()",de(""));
}
</cfscript>
</cffunction>