PoC has written by Soroush Dalili (@irsdl)
Flash "navigateToURL" local-with-filesystem protection bypass - tested in IE10
SecProject.com