The usual solution for the Man-in-the-Middle problem of Diffie-Hellman is to combine it with a public-key authentication solution.
This could either work by including the server's public Diffie-Hellman key (which then must be a long-term key, not a short-term or even session key – this way you lose your forward-security) in the client, or including a signature key (DSA, RSA, ECDSA) with the client, where the server uses the corresponding private key to sign everything what was exchanged. (All those ways of authentication are used in SSL/TLS ciphersuites, by the way.)
Of course, this then poses the problem how the client (i.e. your flash application) comes securely to the browser in the existance of a MitM – so you'll have to also use some authentication solution on the transfer of this, using another public key, maybe certified by some key the users already know (and trust).
By then, you can just use SSL/TLS for the whole communication, both for delivering your flash client as well as to receive the secret data from the server.