struct IActionScriptFunction {
  struct Params {
    IFlashPlayer* pFromPlayer;
    void* pUserData;
    const IFlashVariableObject* pThis;
    const IFlashVariableObject** pArgs;
    unsigned int numArgs;
  };
  struct IReturnValue {
  };
};

IFlashPlayer.h

Clients of IFlashPlayer implement this interface to replace inject C++ code into Action Script

struct IReturnValue {
};

IFlashPlayer.h

virtual ~IReturnValue();

virtual void Set(const SFlashVarValue& value, bool createManagedValue = true) = 0;

Clients setting the return value in their implementation of Call() should think about "createManagedValue". For PODs its value doesn't have any meaning. When passing strings however it offers an optimization opportunity. If the string passed in "value" is managed by the client, there is no need to request internal creation of a managed value (a copy) as the (pointer to the) string will still be valid after Call() returns. However, if a pointer to a string on the stack is being passed, "createManagedValue" must be set to true!

struct Params {
  IFlashPlayer* pFromPlayer;
  void* pUserData;
  const IFlashVariableObject* pThis;
  const IFlashVariableObject** pArgs;
  unsigned int numArgs;
};

IFlashPlayer.h

virtual ~IActionScriptFunction();

virtual void Call(const Params& params, IReturnValue* pRetVal) = 0;