In the course of a pentest I found a Flash movie file (swf) that loads another Flash movie through `loadMovie`. The HTML is this:

    <embed width="388" height="350" src="http://www.domain.com/first_flash.swf?
    videoload=http://www.domain.com/videos/second_flash" quality="high" 
    pluginspage="http://www.macromedia.com/go/getflashplayer" align="middle" 
    play="true" loop="true" scale="showall" wmode="window" devicefont="false" 
    bgcolor="#ffffff" name="interior" menu="true" allowfullscreen="false" 
    allowscriptaccess="sameDomain" salign="" type="application/x-shockwave-flash">

As you can see, there is the `directive allowscriptaccess="sameDomain"`. Also, if you access the Flash file directly I understand that recent Flash plugins use this setting as default.

In the first_flash.swf, I found this code that loads the second movie:

    _root.videourl = _root.videoload + '.swf';
    video.loadMovie(_root.videourl);

I have tested I can actually change the videoload variable to load swf from other domains. But I can't seem to execute javascript with getURL on a second_flash.swf controlled by me.

So my question is, what can I do to exploit this poor design? How can I show that it is, in fact, dangerous?