As with anything else, it's vectored by someone clicking on something they shouldn't. That it leverages Flash tells you a lot, too.

A little common sense and suspicious, coupled with less gullibility, go a long way towards staying safe while browsing the webz.