Cross-Scripting - Adobe FLEX 2-PROGRAMMING ACTIONSCRIPT 3.0 Manual

When you use an tag in a text field to load an external file (as opposed to using a
<img>
Bitmap class embedded within your SWF), a Loader object is automatically created as a child
of the TextField object, and the external file is loaded into that Loader just as if you had used
a Loader object in ActionScript to load the file. In this case, the
getImageReference()
method returns the Loader that was automatically created. No security check is needed to
access this Loader object because it is in the same security sandbox as the calling code.
However, when you refer to the property of the Loader object to access the loaded
content
media, security rules apply. If the content is an image, you need to implement a cross-domain
policy file, and if the content is a SWF file, you need to have the code in the SWF file call the
method.
allowDomain()
Content delivered using RTMP servers
Flash Media Server uses the Real-Time Media Protocol (RTMP) to serve data, audio, and
video. A SWF file loads this media by using the method of the NetConnection
connect()
class, passing an RTMP URL as the parameter. Flash Media Server can restrict connections
and prevent content from downloading, based on the domain of the requesting file. For
details, see the Flash Media Server documentation.
For media loaded from RTMP sources, you cannot use the and
BitmapData.draw()
methods to extract run-time graphics and sound data.
SoundMixer.computeSpectrum()

Cross-scripting

If two SWF files written with ActionScript 3.0 are served from the same domain—for
example, the URL for one SWF file is http://www.example.com/swfA.swf and the URL for
the other is http://www.example.com/swfB.swf—then one SWF file can examine and modify
variables, objects, properties, methods, and so on in the other, and vice versa. This is called

cross-scripting.

Cross-scripting is not supported between AVM1 SWF files and AVM2 SWF files. An AVM1
SWF file is one created by using ActionScript 1.0 or ActionScript 2.0. (AVM1 and AVM2
refer to the ActionScript Virtual Machine.) You can, however, use the LocalConnection class
to send data between AVM1 and AVM2.
470 Flash Player Security