CVE-2010-2884 , like most prior exploits in flash, has the potential to let the attacker run arbitrary code. We're not talking javascript code either.

BTW, anyone else think serving flash-based banner ads from untrusted third parties given its track record is well, the height of irresponsability?