As long as your flash file is in the web path, it can be downloaded with a little creative browsing. Honestly, if your directory structure looks like this:
home->public_html->images
Where, index.php would be in your public_html, you can store the flash file in 'home' and reference it by '../file.swf'. It's not accessible through the web, but your index file will still be able to access it.