this is all documented in Creating Forms in Macromedia Flash/Using ActionScript in Flash forms section of cfdocs. but what the docs aren't saying is that you can potentially use AS in some (to me) strange places. two of the strangest places are in alert message text and tooltips. the tooltips nearly drove me mad trying to figure out why i was getting illegal AS errors in my flash form when none of my injected AS was using any of the restricted keywords. it turns out i had a couple of buttons with the seemingly innocent "delete" word in their tooltips.
so, pay attention. if you're getting seemingly insane illegal AS errors, look to your tooltips and/or your alert messages instead of head-butting your monitor (or bombarding mike nimer with emails).
update: look to your injected ActionScript comments as well.
To get an alert message to say "New record added", I had to break up "New" into pieces. Like this mx.controls.Alert.show('N'+'ew'+' record added.','Alert');
Let me know if this works in tool tips. I haven't tested that yet.