They do not allow the SWF file that initiated the upload or download to access the uploaded or downloaded file or the file's location on the user's disk.The File Reference and File Reference List classes also do not provide methods for authentication.
The File Reference class provides a means to upload and download files between a user's computer and a server.
An operating-system dialog box prompts the user to select a file to upload or a location for download.
Each File Reference object refers to a single file on the user's disk and has properties that contain information about the file's size, type, name, creation date, modification date, and creator type (Macintosh only).
Note: In Adobe AIR, the File class, which extends the File Reference class, provides more capabilities and has less security restrictions than the File Reference class.
For content running in Adobe AIR outside of the application security sandbox, uploading and downloading operations can access files only within its own domain and within any domains that a URL policy file specifies.
Put a policy file on the file server if the content initiating the upload or download doesn't come from the same domain as the file server.
Note that because of new functionality added to the Flash Player, when publishing to Flash Player 10, you can have only one of the following operations active at one time: to stop an operation in progress. Previous versions of Flash Player are unaffected by this restriction on simultaneous multiple operations.
File Reference instances are created in the following ways: method prompts the user for a location to save the file and initiates downloading from a remote URL.
The File Reference and File Reference List classes do not let you set the default file location for the dialog box that the methods generate.