Yes, I was asking the same question and as Lobster said you can include headers in PHP, for example... but I would like to know if there is anything to do to validate these crafted image files because in that case it doesn't matter if you are using flash or not. Well, flash will make it easier to execute it from another domain.