The solution? To whitelist their domain on Flashblock.
I know that Vimeo developers already have many things to do, and managing how an external plug-in deals with their code is probably not how they want to spend their time.
But still, other players usually don't have this problem. And it only started happening after some code has been modified on Vimeo.
Now, it's very unlikely someone will be able to inject Flash malware using Vimeo's website and profit from the whitelist. And I didn't see any Flash ads on their website, which might make them earn money. So the most probable cause is indeed just an accident. Unfortunately, most security problems come from such inoffensive accidents...
I wonder how the next generations will look to the past and judge these mistakes. That is, if they can actually find out when things have actually happened. Without Carbon-14 or physical evidence, they'll have to rely on timestamps. Luckily, these are much more precise and foolproof than some ancient technology...
