It turns out there’s a straight up BUG in IE. When ExternalInterface checks to see if allowScriptAccess is on (via same domain or always), the “available” property returns true, even if access is NOT allowed. This will fool any SWF into thinking it’s allowed to use the ExternalInterface even when it can’t, thus throwing an exception if it’s attempted.

So sadly, not only must you use ExternalInterface.available, you also have to wrap it in a try/catch.

If anyone can tell me why IE behaves this way, I’m all ears.