In the course of a pentest I found a Flash movie file (swf) that loads another Flash movie through `loadMovie`. The HTML is this: <embed width="388" height="350" src="http://www.domain.com/first_flash.swf? videoload=http://www.domain.com/videos/second_flash" quality="high" pluginspage="http://www.macromedia.com/go/getflashplayer" align="middle" play="true" loop="true" scale="showall" wmode="window" devicefont="false" bgcolor="#ffffff" name="interior" menu="true" allowfullscreen="false" allowscriptaccess="sameDomain" salign="" type="application/x-shockwave-flash"> As you can see, there is the `directive allowscriptaccess="sameDomain"`. Also, if you access the Flash file directly I understand that recent Flash plugins use this setting as default. In the first_flash.swf, I found this code that loads the second movie: _root.videourl = _root.videoload + '.swf'; video.loadMovie(_root.videourl); I have tested I can actually change the videoload variable to load swf from other domains. But I can't seem to execute javascript with getURL on a second_flash.swf controlled by me. So my question is, what can I do to exploit this poor design? How can I show that it is, in fact, dangerous?