TL;DR, there's now an easy way to enable MP4 (H.264 + AAC) HTML5 video support in Firefox on Windows XP using the Primetime Content Decryption Module plugin by Adobe (distributed by Mozilla). Meaning, you could get rid of Flash (with some caveats). The irony of course being that you'd have to use another thing by Adobe 
, but at least it's something not as prone to security problems.
NEWS July 26, 2016: Unfortunately, but maybe not all that surprisingly: Primetime CDM will not be getting official support on Windows XP after all. Says a Mozilla developer:
QuoteThe Adobe CDM doesn't work for EME on WinXP, and we were trying to get it working for unencrypted decoding of MP4/H.264/AAC files on WinXP, but it has a bug that causes it to crash on some systems. So we turned unencrypted decoding via the Adobe GMP off. Adobe have decided that they aren't going to support WinXP furthermore, so they're not going to be fixing that bug. We don't want to use unsupported decoder for unencrypted decoding.
Technically, this plugin has been added to FF for DRMed HTML5 video, but it can be used to play non-DRM as well. It's not officially supported on XP, but hey, neither is XP itself, right? 
I've been trying it out with FF 46 (later also confirmed with 45 ESR and 47-51a) on XP Pro SP3 x86 (with POSReady updates, though I doubt that matters any) for about a week now, and the experience has been pretty encouraging. The vast majority of HTML5 videos have worked without a hitch; ~5% have had 1-2 temporary freezes (the video stops, the audio continues with some crackle), which can be easily worked around by moving the video position slider back a bit and then forward again to where the freeze happened. I've seen only one (1) case of a show-stopper error message about "corruption or unsupported features in video" (quote not verbatim) that couldn't be worked around by jiggling the slider (not a crash, just an error message and the video stopped). You may not necessarily be as lucky, though, as the reason the plugin is not included by default by Mozilla is its reported crashing on some high profile sites.
(If you're interested in getting this to work on Windows 2000, be sure to read @blackwingcat's post below in addition to this one, and why not his blog posts (1, 2) as well (in Japanese, but with screen shot images).)
The way to force the installation and operation of Primetime CDM is to add/set the following preferences in about:config :
media.gmp-eme-adobe.enabled (boolean, true)
media.gmp-eme-adobe.forceSupported (boolean, true; FF 49.0+)
media.gmp-eme-adobe.forcevisible (boolean, true; FF 45-48, no longer used in 49.0+)
media.gmp-eme-adobe.visible (boolean, true; FF 49.0+)
media.gmp.decoder.enabled (boolean, true)
media.eme.enabled (boolean, true; defaults to false if you downloaded a DRM-free version of FF; thanks @heinoganda for pointing this out)
45.x.x ESR users *ONLY*: also change media.gmp-manager.url or the Primetime plugin won't get downloaded for you. The default value is "https://aus5.mozilla.org/update/3/GMP/%VERSION%/%BUILD_ID%/%BUILD_TARGET%/%LOCALE%/%CHANNEL%/%OS_VERSION%/%DISTRIBUTION%/%DISTRIBUTION_VERSION%/update.xml", change only the bolded portion as follows: "https://aus5.mozilla.org/update/3/GMP/46.0/%BUILD_ID%/%BUILD_TARGET%/%LOCALE%/%CHANNEL%/%OS_VERSION%/%DISTRIBUTION%/%DISTRIBUTION_VERSION%/update.xml". The host in your default may be something other than aus5.mozilla.org, you only need to change the %VERSION% part.
After this, when you check your Plugins list, you should see a notice about the Primetime plugin getting downloaded shortly. If you don't want to wait, check for updates manually (from the gear button dropdown menu). The plugin files will be placed in the gmp-eme-adobe subfolder under your FF profile.
Once it has downloadedd, set the Primetime plugin to Always Activate, Flash to Never Activate (not strictly necessary, but better for testing), and go to Youtube HTML5 video player check page. Both H.264 and MSE & H.264 should have blue checkmarks. You may want to try this test page (kindly suggested by @dencorso) or some Twitter videos to quickly make sure H.264 really is working (with Youtube you can get fooled by WebM getting played instead).
In theory, you could uninstall Flash at this point, but realistically it's probably wiser for now to leave it installed and disabled in the browser. Personally, I installed the FlashDisable extension to quickly toggle Flash on some of the sites I frequent that don't support HTML5 video. Some of those insistently serve Flash video to desktop FF without even checking if it can do HTML5 video or not. That can be worked around by faking a different user agent string, but for now I've found it more convenient to just temporarily toggle Flash back on for them. FlashDisable supports the Ask to Activate setting, so you don't have to worry about other sites if you forget to turn Flash off again.
Based on what Mozilla devs have been saying on Bugzilla (Unhide Adobe GMP on Windows XP, Hide Adobe GMP on Windows XP in Firefox 46 and 47, Make Adobe GMP available to Windows XP users in Firefox 45 and later) it seems quite possible that this plugin could soon (FF 48+) be made available without having to use any tricks (or pre-release versions), but I suppose it's also possible that the current situation will continue indefinitely (or even that the plugin will eventually be made more difficult to access under XP). Still, why not make use of it while we can, right? 
Note that HLS streaming is not natively supported with this plugin. It does work on sites coded to use some JS library or player to work with HLS, but not for directly playing .m3u8 video sources. You may want to keep an eye on developments with hls.js in general and firefox-hls in particular if a favorite site of yours falls into the latter category.
There was some discussion about this in the Chrome thread, but I thought it better to create a separate topic instead of having posts buried in a different thread. The most relevant parts are here: 1 (VistaLover), 2 (dencorso), 3 (VistaLover). Since it appears to have ended on a failure, I'm taking the liberty of restating some of what was covered by them. I don't mean to overstep or hog the glory by any means, so if the mods want to prepend those posts to this thread, I have no objection.
P.S. Hi everyone and thanks for the truckloads of useful information that's been posted here in the past. I've been lurking for about 1.5 years already and thought it was about time to contribute something.