loadVariables only from my server

If the form is never mentioned (ie the_form.php) inside flash - how will an “injector” be able to mimic a form call? (Not to mention without knowing what the form variables are)