When run standalone, the movie has "master" privileges, which allows access to the local file system using the "file://" protocol. As a widget run from profile.xml, it has "slave" privileges, which does not allow such access.
To override this, you'll need to explicitly enable slave privileges and use the "sys://" protocol instead of "file://" (they're otherwise the same).
To enable slave privileges, you'll need to create the file "/psp/flashplayer.cfg" with the contents:
PrivilegedCallExceptions 65535
...and restart the Control Panel. This allows the slave (ie widget) to do anything the master (ie Control Panel) can do. It also makes your device's security much, much weaker.