It's definitely possible to use local xd_receiver.htm files. I'm a Facebook app developer by trade, and I have dozens of them set up.
You're closest to the correct answer with your #2 above. The way to do it is create two versions of your app. If I was making "MyApp", I might have two Canvas Page urls of "myapp" and "myapp-dev", and corresponding Canvas Callback URLs of "www.myapp.com" and "192.168.1.1". Each one is a separate Facebook app, with their own API key, etc.
apps.facebook.com/myapp would go to my live server, and apps.facebook.com/myapp-dev would go to my local development machine. You have to make sure Facebook can get to your development machine of course.
However, things should work just fine from there. You don't even need different versions of the xd_receiver.htm file, as the file contents are always the same for every app. AS long as your FB.XdComm.Server.init("/xd_receiver.htm");
line points to the right file, it should work.
I manage API keys and paths and such in a configuration file, and have one configuration file per application, whether it be a dev or production app. That makes it easy to output correct keys and paths on the app pages.
You can keep your development app in sandbox mode and do all the work on your local machine.