Busting sanctions
The sandbox allows a Shockwave Flash (SWF) file to read local files but not send data over the network. It also prevents SWF files from making JavaScript calls or HTTP or HTTPS requests, Rios wrote. A local file is described as one that can be referenced using "file: protocol" or a Universal Naming Convention path, Rios wrote.But Rios found that the sandbox restrictions are actually not quite so strict. He found he could bypass the sandbox but reformatting the request, such as "file://request to a remote server." Adobe, however, limits those requests to local IP (Internet protocol) addresses and hostnames, Rios wrote.
The link for this article located at Tech World is no longer available.