It runs in a separate process. I don't think that process is sandboxed in Firefox. And you probably can't restrict it too much or most Flash apps wouldn't work.