I understand this is a very specific, obscure question, so don't @ me with use cases or best practices. I know to test for feature-specific support. I understand that IE is horribly outdated.
IE6 can sometimes report as IE7 after the Windows Service Pack Update (SP3). I can reliably test for IE6 masquerading as IE7 by using conditional compilation and feature detecting XMLHttpRequest, but I am pretty sure that IE7 in IE6 document mode (or earlier modes, honestly) will also test negative for XMLHttpRequest.
Is there a way to reliably determine whether IE's browser engine is IE6 or 7, regardless of document mode?

Document Mode is a feature that isn't supported until IE8.
So all you need to do to is check for a feature that is supported in IE7, but not IE6.