Cross domain issue when calling Apex Code from Flex

I’m trying to invoke Apex code exposed as a web service from Flex using the Flex Toolkit, and am having cross domain security issues again. It works fine when I run it as a local file. When running from a domain, I get back "Security error accessing url."

The policy file that the Toolkit loads is at:

http://na3-api.salesforce.com/services/Soap/u/cross-domain.xml

But the endpoint that I’m calling is at:

http://na3-api.salesforce.com/services/Soap/class/MyClass

The Flash Player Security White Paper says “The scope of the permissions defined in a policy file includes all resources within the directory and within nested subdirectories.”

So it appears that the above policy file only supports API calls, and not Apex Code calls. Is there, or could there be, a policy file to support both?