Seen this?

[Gene Spafford <spaf () CERIAS PURDUE EDU>]

I had someone get a " Thanksgiving greeting card" purporting to be from sendfriendlygreeting.com
It had a flash file in it.  

There is no such domain.

Anyone seen anything like this?  Is there a canonical list of where Flash exploits plant things?