According to the AS3 documentation:
In Flash Player 10 and later, if you use a multipart Content-Type (for example "multipart/form-data") that contains an upload (indicated by a "filename" parameter in a "content-disposition" header within the POST body), the POST operation is subject to the security rules applied to uploads:
- The POST operation must be performed in response to a user-initiated action, such as a mouse click or key press.
- If the POST operation is cross-domain (the POST target is not on the same server as the SWF file that is sending the POST request), the target server must provide a URL policy file that permits cross-domain access.
The reason my request is failing is the first bullet point, since my POST isn't done "response to a user-initiated action, such as a mouse click".
Quite how moxie expects me to do this I'm not sure, as all their (scarce) documentation indicates that cross-platform multipart uploads are possible.