Due to a design flaw in ActionScript 3 socket handling, compiled Flash movies are able to scan for open TCP ports on any host reachable from the host running the SWF, bypassing the Flash Player Security Sandbox Model and without the need to rebind DNS.
You can download this advisory from the following link: https://packetstormsecurity.com/files/download/58417/as3socket.txt
Source: https://packetstormsecurity.com/files/58417/as3socket.txt.html