This is a very serious issue regarding the new Flash Player 8 security sandbox.
how can a flash movie loaded from a non-local url (http://) read files from a local path?
The answer so far seems to be that it can't:
Loading restrictions: SWF and HTML content from non-local URLs may no longer load any content (SWF, HTML, PNG, and so on) from local paths.
I personally am not currently bugged by this issue but
other people are. And are also bugged by the vague responses from MM officials. I got one of those as well on FlashCoders. But I think that the evasive replies are intendet for avoiding a straight result on google so that anyone finds out easy about the glitch. The article is 9 pages long and not easy to digest but it's worth reading.
I recently switched an "in browser" kiosk app to flash8 and was surprised to see that my main swf that was loaded in the main html page was no longer able to load the interface assets located in a second .swf file.
When the app was running in player 7 there were no problems doing this action.
When the app was running in flash 8 but was exported for player 7 the "security warning" popped up and the user had to go to MM's site to mark the file as "trusted".
When the app was exported for player 8 and running in player 8 there was no warning and the assets wouldn't load.
My lucky break was that I was using a master .exe file (converted from a .swf) that was initializing the entire app. So after a lot of diggin trough
this article I found out about the top secret .cfg trust files that were created by the MM security interface on the user's computer. Those files are used to declare the folders on the computer that are fully trusted (to access the net and local resources).
MM official stand on this is that if a user allows a .swf to access both resources or runs a .exe that does this then he knows that the content in discussion can be trusted.
My opinion is that although that's not the case this solution is a good enough compromise between the needs of developers and those of the security of the user. The best illustration of the new security is on
this page and you can clearly see the tightness of the
"remote loading" scenario (last colum to right). Lots of red cells and only
"remote loading remote" allowed.
So if u want to make cool standalone apps either u wrap them using a swf_To_exe (
screenweaver is a good free os solution) or you write a nice tutorial about creating and properly locating .cfg files.