I ran this app on my own Flash App (http://moshimonsters.com/) and it produced a plethora of "Vulnerabilities" - and really dangerous ones too like "Interesting Variable Name" (a variable named "masterList") and "Possible userdata information" (a constant named "LOGGED_IN")...
To be honest this seems like a lot of FUD being generated by HP - I mean just go look at the dailyWTF and you'll see programmers butting SQL statements in javascript! Still, I must give credit where it's due and thank HP for providing one of the most thorough SWF decompilers I have seen for free.