In Windows XP, it seems that the Flash plugin can install and run
software without going through the usual OS confirmation screen.

see for instance http://www.adobe.com/products/digitaleditions/

I thought such privileges are not given to any plugin - if so, how can
you trust any webpage using embedded flash content to not install
anything upon a few clicks or even automatically?

Sponge