Security errors are thrown when an operation is not allowed in the security environment in which the application is running. This may have several reasons: none of them try to access the local file from the application that was compiled using use-network=true .
EDIT
After reading your question, I came across the most likely reason, but in any case I will leave other information - this may be useful to other users.
You download the image gallery, which in turn downloads other files (XML), but the external SWF was compiled with the use-network option, and the FLA automatically starts as a local-trusted application when exporting from the Flash IDE. This, of course, is a violation of the sandbox.
You can test this by running SWF from a web server with a valid security policy - if I assume that your application should work then.
By the way, if you add an event listener to contentLoaderInfo to handle security errors, you can prevent your application from crashing and exit.
End edit
The error may be due to a small delay between the bootloader instance and the initialization of its security context. See this blog post for more details.
If this is the case, you should be able to properly get rid of the error by delaying the load request using setTimeout() or by moving the declaration of your loader outside the function block, i.e.
var mLoader:Loader = new Loader(); function startLoad() { var mRequest:URLRequest = new URLRequest("../xml_gallery_2_852/XMLGALLERY2.swf"); mLoader.contentLoaderInfo.addEventListener(Event.COMPLETE, onCompleteHandler); mLoader.contentLoaderInfo.addEventListener(ProgressEvent.PROGRESS, onProgressHandler); mLoader.load(mRequest); }
Declaring your loader as a temp variable is dirty anyway: the link is lost, but the event listeners you added to contentLoaderInfo keep it in memory, whether it is needed or not. This can cause serious memory leaks if you intend to download more than one file. You should always specify a link to your loader if you want to properly utilize downloaded content when it is no longer needed (using Loader.unload() ), and make the loader accessible for garbage collection (by deleting event listeners and explicitly after using the link on null ).