Ressurrecting this thread since I missed it to begin with:
And good news, Chrome M47 is out and fixes it.
It wasn't intentional - if you look at the
bug report, they enabled secure origin enforcement for webrtc (only allowing https sites and file:// URLs and to use the camera/microphone), but accidentally this also enabled it for flash. But looking at the commit message for the fix, they mention in passing this enforcement will also be done later for Flash ("This special case should be removed after HTTP access for Flash has been deprecated (crbug.com/526324)." , but like all Chrome security bugs, access is limited to Chrome developers only ) , so it would still make sense to nag MFC to move the flash applets to be served over https (and wouldn't hurt if they also checked if RTMPS is in use).