Javascript :: Allowing Flash Movie To Communicate To Containing Window Without Exposing Full ExternalInterface?

I'm working on a site that allows administrators to upload arbitrary SWFs and embed them on the page. Administrators are in theory trusted, but I still want to protect against potentially malicious administrators or misguided administrators from harming the site.

A part of the functionality of the site is that the SWFs can communicate to the containing browser page when it's finished and for the page to react.

Now, I can think of two ways to do this:

Use ExternalInterface.addCallback to create a global callback named something like isComplete that does logic and returns true or false depending on whether the Flash app is in a completed state. Then, just do something like setTimeout to just call that function repeatedly. I don't think this would require me to open up allowscriptaccess to the movie. Embed the movie with allowscriptaccess and have the movie call something like ExternalInterface.call('done') when it's finished. This option seems like it requires me to open up allowscriptaccess, which is a potential threat since I can't control the SWFs that would be embedded with this directive.