Only browsers with an old version of Flash installed can be tricked into executing a forged cross-site request. The attacker wouldn't gain anything by installing it on their own machine.