Flash crossdomain multipart POST not working?

Question

I'm using moxie as an XHR2 polyfill to issue a crossdomain POST file upload, using a FormData to construct a multipart request containing a File object from a FileInput.

Using the HTML5 runtime, the request is successful and the file is uploaded. However, when using the Flash runtime, crossdomain.xml is successfully requested, but the request soon hits readyState 4 with a status of 0, suggesting the request was cancelled because it was an invalid cross-domain request.

The crossdomain.xml spec mentions nothing about request methods. A quick search on the moxie Github turns up this issue, which seems to have been resolved, although the issue is still open. Unlike in the issue, I'm not seeing any request go through after crossdomain.xml.

The code to send the request:

var xhr = new moxie.XMLHttpRequest();
xhr.open('POST', url, true);
xhr.bind('load', function() {
  if(this.status === 200) {
    // yay!
  } else {
    // boo!
  }
});

var form = new moxie.FormData();
form.append('file', file); // file is a moxie.File from a FileInput

xhr.send(form);

My crossdomain.xml is the following:

<?xml version="1.0"?>
<cross-domain-policy xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
    xsi:noNamespaceSchemaLocation="http://www.adobe.com/xml/schemas/PolicyFile.xsd">
  <allow-access-from domain="*"/>
</cross-domain-policy>

Answer 1

According to the AS3 documentation:

In Flash Player 10 and later, if you use a multipart Content-Type (for example "multipart/form-data") that contains an upload (indicated by a "filename" parameter in a "content-disposition" header within the POST body), the POST operation is subject to the security rules applied to uploads:

• The POST operation must be performed in response to a user-initiated action, such as a mouse click or key press.
• If the POST operation is cross-domain (the POST target is not on the same server as the SWF file that is sending the POST request), the target server must provide a URL policy file that permits cross-domain access.

The reason my request is failing is the first bullet point, since my POST isn't done "response to a user-initiated action, such as a mouse click".

Quite how moxie expects me to do this I'm not sure, as all their (scarce) documentation indicates that cross-platform multipart uploads are possible.