The way to get around this is to use url encoding.
<param name=\"flashvars\" value=\"file=http://localhost:13196/scripts/Video.ashx?id=abc%26l=es-MX&image=http://localhost:13196...>
The & after the id has been replaced with a %26, which represents an & in url encoding.