Flash applets can be used for CSRF exploits but it depends on the same-origin policy or XML-RPC or similar.
If you want to send a XML-RPC request with an xml body in an html form you must use a form like this:
<form name="x" enctype="text/plain" action="" method="post">
<input type="hidden" name='<?xml version'value='"1.1"?><a><b>blah blah</b></a>'>
(But if the web application or server checks the content-type it will not work.)
and for same-origin policy :
CSRF in Plupload (CVE-2012-3415)
So, if an attacker could convince a target to interact with the applet (by selecting a single file to be uploaded), the attacker could make a request to the domain that the applet was hosted on and read back the full response. That could disclose CSRF tokens or other sensitive information. This issue was especially important for Wordpress installations, where Plupload applets are hosted inside of the wp-includes directory by default.
The issue was resolved by removing the call to Security.allowDomain('*') by default.
Additionally, Flash applets can have XSS vulnerabilities as well.
Read More And Reference