Consider this testcase:

<object type=application/x-shockwave-flash>
  <param name=movie value=test.swf>
</object>

This apparently (according to https://bugzilla.mozilla.org/show_bug.cgi?id=517440#c0) loads test.swf in IE, Blink, and WebKit. Per spec, and in Firefox, it does not.

This param is NOT processed by Flash itself afaict. If it's getting loaded at all, it's the browser doing it. So the spec should probably specify this behavior, since most browsers do it.

It's worth figuring out what the actual required behavior here is, by the way. Today I ran into a page that had this markup on it:

<object>
  <param name=movie value=test.swf>
</object>

(note no type attribute) and WebKit/Blink happily loaded that as Flash. Neither IE nor Firefox did. I looked at the Blink code for this, and its behavior is summarized in https://bugzilla.mozilla.org/show_bug.cgi?id=517440#c2, assuming I understood it correctly.

So at the very least we need to figure what set of param names reliably gets treated as a url in IE. We also need to figure out whether we want the Blink/WebKit behavior of using a type sniffed from a param-provided URL if no type is specified. Seems like that would at least be consistent with what happens if no type is specified by the data attribute is specified.