Currently it is set to 'always' (default value used e.g. by flowplayer) which can be potentially dangerous. Set the AllowScriptAccess parameter to 'sameDomain' which tells the Flash Player that only SWF files loaded from the same domain as the parent SWF will have script access to the hosting web page.