allowscriptaccess="sameDomain"
<param name="allowScriptAccess" value="sameDomain" />