This Macromedia policy talks about how one should always verify input from parameters passed to any application, and focus specifically on Flash advertisements that "frequently make use of a clickTAG parameter to allow the HTML pages that contain them to specify the click-through destination URL for the advertisement." A malicious HTML page could be constructed to pass a specially constructed URL parameter containing JavaScript or malicious code. This can all be prevented if you utilize the best practice of always checking your Clicktag parameters to make sure they start with HTTP:.