Oracle Database Discussions

While researching Oracle's XML utilities, I ran into this statement:

"Before database startup, you must specify the read-from and write-to directories in the initialization.ORA file; for example: UTL_FILE_DIR=/mypath/insidemypath"

located at the following link:

http://download-uk.oracle.com/docs/cd/B19306_01/appdev.102/b14259/xdb10pls.htm

I had understood that utl_file_dir is deprecated in favor of Oracle Directory objects.

I then found a suggestion to set utl_file_dir to an asterisk (*), while other reading said this is a bad idea, from a security point of view. The main reason we're looking at the asterisk is that we have multiple systems/schemas on the database server, each writing to its own directory.

So these are my questions:

Does DBMS_XMLPARSER really require the utl_file_dir parameter instead of directory objects and is there a reason for that?

Is it okay to set utl_file_dir to an asterisk, or is it a bad idea? If it's a bad idea, can I point utl_file_dir to several directories on the server by comma or semi-colon delimiting the directories (I've looked for examples but no luck so far)?

Thanks!