title: Is there reliable method of ensuring crossdomain policy files have been retrieved for all Facebook image servers?
body: <p>I've recently started putting together a Facebook Connect AS3 app and retrieving objects and images through the Graph API.</p>
  
  <p>Running anywhere but locally, I receive security errors of the form:<br>
      SecurityError: Error #2122: Security sandbox violation: Loader.content: xxxx cannot access <a href="http://photos-a.ak.fbcdn.net/xxxx.jpg" rel="nofollow noreferrer">http://photos-a.ak.fbcdn.net/xxxx.jpg</a>
      A policy file is required, but the checkPolicyFile flag was not set when this media was loaded.</p>
  
  <p>If I add a line of the form:<br>
      Security.loadPolicyFile("ht_tp://photos-a.ak.fbcdn.net/crossdomain.xml");<br>
  -then I'm fine for that server, but it seems that there are any number of domains with the photos-[letter] format. I've added the one for each in the alphabet - which happily retrieves crossdomain files successfully - but it doesn't seem like a nice solution, and doesn't accommodate any new hosting setups Facebook <strike>may</strike> will implement in the future.</p>
  
  <p>One thing I'd considered was retrieving the crossdomain policy file on a per image basis, capturing the domain from the image URL before making the image request. Unfortunately, at least via the Graph solution (and I haven't looked too closely at the others), their servers resolve the image url after the request is made, from something more generic like:<br>
      ht_tps://graph.facebook.com/[objectId]/picture?type=small&amp;access_token=[accessToken]</p>
  
  <p>Has anyone found a more dependable means of ensuring that images can be retrieved without security sandbox violations? Or do Facebook maintain a definitive list that developers need to keep an eye on?</p>
  
  <p>Thanks!</p>