Flash 9 Player introduce a new security model, the basic concepts are:
- Resources in the same security sandbox (local or network) can always access each other .
- Resources in a remote sandbox can never access local resources
Now the flash player checks for "exact domain" so:
http://a.com
http://www.a.com
http://www.a.b.com
https://www.a.com
are different sandbox.
You can bypass the sandbox using cross domain xml and Security.allowDomain() method
source:
http://www.adobe.com/devnet/flashplayer/articles/flash_player_9_security.pdf