I just wanted to mention that I was able to get flashnode working with private uploads by adjusting the $conf array in settings.php and then creating a symbolic link to the unaccessible flash directory.

For example:

$conf = array(
'swftools_media_url' => '/symbolic-link-to-flash-files-in-private-directory'
);

I know somebody was having a problem with that.