Flash is executed by the browser, so all it's going to take for this to be real nasty is a forum like this that allows users to upload files to use in their sigs. Then anyone who looks at a thread where that user has posted is done.