Security researcher finds way around Flash sandbox