Is there a cross domain policy restriction for subdomains?
If I have an application on paint.xxxx.com
which is manipulating images from image.xxxx
yes the cross domain restriction applies for subdomains.
The solution is to put
document.domain = "example.com" ; // whatever your domain name is
in the top of the js file(s) for both the parent domain and the child domain
Google Document.domain and cross site and there should be a better explanation but I've had the same issue and that is what worked for me.