In general, an SWF from a web-server cannot read files from the client machine. But it can upload user-selected files from the client machine to the server. An operating-system specific dialog box prompts the user to select the file to be uploaded to the server. Hence Flash cannot read any file it wants, only those that are explicitly permitted by the user.
Before Flash player 10, the SWF didn’t have direct access to the contents of the file being uploaded – all it did was act as an interface to select the file and send it to the server. The only way to get its contents was to send it back from the server to the SWF using URLLoader.
However starting from FP10, the FileReference class has load() method that allows you to load the user selected file directly to the SWF, instead of passing it through the server.
Similar rules apply to downloading – files can be saved into user’s machine only with their permission and at the location and name specified by the user. Before FP10, you could only download a file from the server to the client – if you had to save some image created using your SWF to the client machine, you had to send it to the server and then prompt user to download it. Starting from FP10, you can write the data directly from SWF (with permission from the user, of course).
In addition to these, an SWF can store SharedObjects in the client machine which is analogous to the browser cookies. Storing shared objects doesn’t involve any dialog boxes or permissions from the user. The following is quoted from the livedocs page linked to above.
Local shared objects have some limitations that are important to consider as you design your application. Sometimes SWF files may not be allowed to write local shared objects, and sometimes the data stored in local shared objects can be deleted without your knowledge. Flash Player users can manage the disk space that is available to individual domains or to all domains. When users decrease the amount of disk space available, some local shared objects may be deleted. Flash Player users also have privacy controls that can prevent third-party domains (domains other than the domain in the current browser address bar) from reading or writing local shared objects.