They can still download it. The only way I can think of is having one SWF as a shell that loads another one without disclosing the URL.The only way I can think of is by embedding the SWF file in an HTML page. That should make Firefox/IE/Chrome/whatever open it up rather than want to download it.