For those who attended my “Rich Internet Applications with Flash, PHP and MySQL” at the DC PHP Conference, you will remember Rasmus mentioning the request header security bug in IE 6. I haven’t found an admission of guilt from Adobe, but there are some articles out there about this.

http://www.securityfocus.com/archive/1/441014/30/0/threaded
This actually affects IE 6.0, Microsoft IE 6.0 SP2 and FireFox 1.5.0.4, running Flash 8.0.22.0
and Flash 7.0.19.0.

Click the above link to find out more info and ways to duplicate this issue.