Is it possible to brute force a flash login with hydra?
If not, what is a good tool to pen test a flash login?
You could use Burp Intruder. This is only in the paid version of Burp, but it's not that expensive.
You would first capture a manual login using the proxy, then use Intruder to fuzz for valid passwords.
You should MITM the connection to see the actual HTTP request sent by the Flash applet (or use your browser's developer tools, they may display Flash-originated requests too).
Once you know what request is made you should be able to replicate it with Hydra.