TL;DR: generally no, it is not possible to figure out your IP assuming the Whonix VM is congigured correctly as you describe, and ALL traffic tunnels through Tor.
Long story, there are several ways for Flash applets to find your real IP. As stated above, none of this applies to Whonix which protects against all of them. Those are listed here for the education purpose, and to explain why other Tor configurations (such as Tor Browser Bundle or Tails) still could be vulnerable to those.
The most obvious way is to request a specific URL from Flash itself, and see the IP in the server logs. If the Flash traffic is routed through Tor, this will return the IP of Tor exit node. Tails protects against this, but Tor Browser Bundle, as far as I know, does not (and this is why Flash is disabled in TBB).
It is possible (in Adobe Air 2.5) to enumerate local interfaces and find out the IP there. In your configuration this would probably be a nondescript IP such as 10.x.x.x which will give out no information. Same as above.
It is possible to use a browser exploit, and then run some code in your VM. This code will not be restricted by Flash policies, and could leak your IP depending on how tight the configuration is.
For example, Tails enforces routing of traffic through Tor via the firewall rules. If an exploit gains root privileges, it can flush the firewall rules table, effectively disabling this rules enforcement. Then every request (such as wget to whatismyip.com) would return the IP address.
However if the rules are enforced at the workstation itself (i.e. the VM can only talk to workstation no matter what the VM firewall/NAT configuration is), this will not work. Still, there are other possible ways. For example, if VM only firewalls TCP traffic, but passes ICMP traffic (Tor cannot really tunnel ICMP or UDP, only TCP), it is possible to send the information via ICMP. Also if DNS requests are not filtered by Whonix, it is possible to set up your own DNS server for a domain, perform DNS lookup for domains such as 192.168.0.1.yourdomain.com and log the requests on your DNS server. However with proper filtering - which I believe Whoenix is doing - this should not be possible.