If I'm not mistaken, REFERER is passed in through the incoming headers. So maybe your Flash script isn't handing any out. If this is the case, then maybe you could try testing for $HTTP_REFERER, and if it is present, test again to see that it is your server. Otherwise, deny permission. ie:
function checkReferer()
{
if(strstr($SERVER_NAME, $HTTP_REFERER))
return true;
}
if ($HTTP_REFERRER && checkReferrer())
echo "This is a polite message to you: you can't use my script without permission!";
else
echo "Do your stuff, because it's probably coming from your own server.";
Hope that was useful ...