I have a game on facebook which is talking to its javascript container. I am using ExternalInterface to pass parameters to the JS - this is working flawlessly. The problem starts when I want to pass data to the SWF - when running the game outside of facebook, everything works smoothly - I can pass data to the SWF with no problems. However, when running under facebook - then I get the "error on NPObject" message. I have allowscriptaccess set to true, and I can still call JS function on the page, just not the other way around, and only when running under facebook...
Edit: Apparently, this issue happens when a user disables the secure browsing in their facebook privacy settings, so this must be some cross-domain issue.