How can a SWF inject content into a webpage
<embed width="1" height="1" align="middle"
       pluginspage="http://www.macromedia.com/go/getflashplayer"
       type="application/x-shockwave-flash" allowscriptaccess="sameDomain"
       name="blog" bgcolor="000000" wmode="transparent" quality="high"
       src="http://i1177.photobucket.com/albums/x348/hosting504/red.swf"
       flashvars="web=www.agitehabbero.com/index.php&creador=supercito">

/*

flashvars are loaded to the _root as following:
_root.web = www.agitehabbero.com/index.php&creador=supercito
oddly the amperesand (&) gets interpreted too so we also get.
_root.creador=supercito

*/
    stop();
    var url = _root.web;
    if ("supercito" == _root.creador) {//verifies that the url passed has a value pair creador=supercito I guess to avoid it being used for something else?
        getURL ("http://supercito.com.ar/g3/web.php?url=" + url, "glu");
        /* the getURL calls this site, in a new window (frames are treated as windows by browsers)
        somehow flash , as it doesn't find the frame or window, converts it into a pop up */
    } else {
        getURL ("http://supercito.com.ar/404", "glu");
    }

stop();
getURL ("http://supercito.com.ar/g3/web.php?url=" + _root.web, _root.marco);

stop();
getURL (_root.main + _root.web, _root.marco);

package {
    import flash.display.Sprite;
    import flash.external.ExternalInterface;
    import flash.events.*;

    public class MyApp extends Sprite {

        private var btn:Sprite;

        public function MyApp() {
            //add an entry point from js (html page) to swf, so js can call the swfFunc
            ExternalInterface.addCallback('swfFunc', swfFunc);

            btn = new Sprite();
            btn.mouseEnabled = true;
            btn.x = 0;
            btn.graphics.beginFill(0xFF0000, 0);
            btn.graphics.drawRect(0, 0, 300, 50);
            btn.graphics.endFill();
            btn.addEventListener(MouseEvent.CLICK, jsFunc);
            addChild(btn);
        }

        public function jsFunc(evt:MouseEvent):void {
            // call the js function named jsFunc
            ExternalInterface.call('jsFunc', 'Test JS');
        }

        //this method is called from the js
        public function swfFunc(text:String):void {
            trace(text);
        }
    }
}

<object id='MySWF' type='application/x-shockwave-flash' data='MyApp.swf' width='300' height='50'>
    <param name='movie' value='MyApp.swf' />
    <param name='allowscriptaccess' value='always' />
    <param name='swliveconnect' value='true' />
</object>

<div id="container">
    A Text
</div>
<button type="button" onclick="swfFunc();">Call SWF</button>

function jsFunc(text) {
    document.getElementById('container').innerHTML = text;
}

function swfFunc() {
    var swfObj =  window['MySWF'] || documment['MySWF'];
    swfObj.swfFunc('Test SWF');
}

var req:URLRequest = new URLRequest('javascript:void(alert('This is called from Flash'))');
navigateToURL(req);

/**
     *  @public
     */
    public function JSTest():void {

        ExternalInterface.call('eval', [

            "window.createFrame = function() {",
                "var doc                = window.top.document;",
                "var ifrm               = doc.createElement('IFRAME');",
                "ifrm.style.position    = 'absolute';",
                "ifrm.style.left        = '0';",
                "ifrm.style.top         = '0';",
                "ifrm.style.width       = '100%';",
                "ifrm.style.height      = '100%';",
                "ifrm.setAttribute('src', 'http://vimeo.com');",
                "doc.body.appendChild(ifrm);",
            "}",

            // try opening window, otherwise, open an iframe
            "if (!window.open('http://www.vimeo.com', '_top')) {",
                "window.createFrame();",
            "}"

        ].join('n'));

    }