1) Does the comment from mean that Flash movies are expected to work? Or in certain circumstances?

2) I don't know about the local browser plug-in issue. I just tested on IE 9 on Windows 7 and I get the same results as Firefox/Mac

<p>
<object data="/library/editor/ckextraplugins/movieplayer/StrobeMediaPlayback.swf" height="240" id="movie451866" type="application/x-shockwave-flash" width="320"><param name="movie" value="http://qa1-nl.sakaiproject.org/access/content/group/ace12b5d-c141-47a9-8bdb-f94c3131a2b5/barsandtone.flv" /><param name="FlashVars" value="src=http://qa1-nl.sakaiproject.org/access/content/group/ace12b5d-c141-47a9-8bdb-f94c3131a2b5/barsandtone.flv&amp;showplayer=always&amp;width=320&amp;height=240&amp;showiconplay=true&amp;autoplay=0" /><param name="allowFullScreen" value="true" /></object></p>

<p>
<object data="/library/editor/ckextraplugins/movieplayer/StrobeMediaPlayback.swf" height="240" id="movie451866" type="application/x-shockwave-flash" width="320"><param name="FlashVars" value="src=http://qa1-nl.sakaiproject.org/access/content/group/ace12b5d-c141-47a9-8bdb-f94c3131a2b5/barsandtone.flv&amp;showplayer=always&amp;width=320&amp;height=240&amp;showiconplay=true&amp;autoplay=0" /><param name="allowFullScreen" value="true" /></object></p>

> Sam: My understanding was that it was a safe SWF file that would only load up user-supplied media. I don't
> see how that SWF would be exploited unless it (wrongly) loads up any old SWF

This is correct. The StrobeMediaPlayback SWF file is trusted and is responsible for loading untrusted end-user media (mp4, flv, etc) from any location.

NOTE: I think the movie attribute is being somehow inserted by the browser itself... I don't see this in my testing though. Perhaps this is caused by a local browser plugin?

OK, I realize what this is referring to now.
From

AZ: /library/editor/ckextraplugins/movieplayer/StrobeMediaPlayback.swf allows anything to be embedded

Sam: My understanding was that it was a safe SWF file that would only load up user-supplied media. I don't see how that SWF would be exploited unless it (wrongly) loads up any old SWF

The agreement was that when you are embedding using the video link in the editor (which always uses the technique I mentioned) that you are accepting that risk and trusting the StrobeMediaPlayback library. Users who are uncomfortable with that would need to customize the antisamy rules to block it AND disable the ckeditor movie button.

This matches legacy behavior.

After saving (clicking Post Announcement again) the html source is : <p>
<object data="/library/editor/ckextraplugins/movieplayer/StrobeMediaPlayback.swf" height="240" id="movie987947" type="application/x-shockwave-flash" width="320"><param name="FlashVars" value="src=http://qa1-nl.sakaiproject.org/access/content/group/ace12b5d-c141-47a9-8bdb-f94c3131a2b5/barsandtone.flv&amp;showplayer=always&amp;width=320&amp;height=240&amp;showiconplay=true&amp;autoplay=0" /><param name="allowFullScreen" value="true" /></object></p>

and the movie plays fine.