How can I get my application to run in the application sandbox no matter where content is loaded from, yes I know about the security implications. I notice that BrowserInvokeEvent has the sandboxType property but this is bypassed when launchApplication is called from the air.swf. Perhaps calling BrowserInvoke could help but can't finad any docs on how to do it.
All content installed with the application (in the application directory) runs in the AIR application sandbox. This is true even if the application is invoked by the browser.
The sandboxType and securityDomain properties of the BrowserInvokeEvent object simply define the sandbox type and domain of the browser page that invokes the AIR application.
If you want your application to load content from outside of the application sandbox, you can grant that content access to methods and properties of content in the application sandbox. This is called a sandbox bridge. Using a sandbox bridge, you can carefully grant non-application content access to functionality in the application sandbox. For more information, see the following: