OK, getting this to work properly was a nightmare, so I decided to put this up for others.
Hosting the flash activex requires that you call OleCreate with an IStorage that implements SetClass (can be no-op), and a IOleClientSite that implements:
IOleInPlaceSiteEx:
OnInPlaceActivateEx() (no-op)
GetWindow()
GetWindowContext()
IOleClientSite:
ShowObject() (no-op)
However, any external resources the loaded swf accesses must be fully qualified, or it will fail with errors like:
Error #2032: Stream Error. URL: file://<relative path>
I'm posting what I figured out as an answer, tell me if this is not propper Stackettique.