I can confirm that it was due to VM::isInitialized() allowing this check to be omitted for the first SWF.

This was a hack that used a truly awful design to do something quite useful, and now the singletons have all gone there isn't a ready-made way to do it. The options are: stick with what we have now, which is consistent but awkward, or add a way to disable this check and do so for the initial SWF. Any preferences?

-u is used as -U if -U isn't given.

It's not about whether it's an allowed resource or not (this is to do with adding a sandbox path, which is still done).

It's the fact that the specified original URL (passed using -u) is a non-local file, yet the first file loaded is a local file, and this is forbidden by the URLAccessManager.

I'm pretty sure we always used to check against this URL. The only difference I can think of is that the static VM::isInitialized() would have evaluated to false at the time of the first check, so the check could be omitted for the first SWF loaded only (i.e. the starting SWF). Now if I can work out how to view older revisions with git I'll try to confirm.

Yeah, might be annoying. Anyway, use standard input and it'll work.
I belive we used to add the command-line given path to the list of allowed resources for this specific purpose. Duno if we're still doing it.

Well, that's embarrassing - the '-u' wasn't meant to be there (but I'm sure I did try it with just '-U', with the same problem).

Anyway, after a rebuild it all seems to work.  I'll let you know if I see it again.

I'm having trouble running a local copy of a downloaded swf.  (I want to be able to edit the swf to isolate testcases from it.)

The two relevant lines in the debug output are:

3398:1] 12:51:21 SECURITY: Checking security of URL 'file:///home/tim/src/gnu/gnash/iplayer/player.swf/player-18269_21576.swf'
3398:1] 12:51:21 SECURITY: Load of file /home/tim/src/gnu/gnash/iplayer/player.swf/player-18269_21576.swf forbidden (starting url http://www.bbc.co.uk/iplayer/episode/b00vky79/Off_the_Page_Living_Cheap/ is not a local resource)

I've attached my two scripts to show how I'm trying to run gnash - 'run' works, but 'run2' gives the above errors.  (I haven't attached the cookies file for the moment.)  I've tried '-u' instead of '-U', but that didn't seem to help.

I'm using git master (821944e) - run2 seems to work with Debian's 0.8.8 package, so this might have been a recent regression.  I'm currently suspecting commit 1d9727ab (removing VM singleton) which touched the function containing that error message - but haven't bisected to prove this yet.