In code I use this before URLLoader (swf will be used with many different domains and this will be changing in time):
Security.allowDomain(\"*\");
Cross-domain policy errors are always a pain in the ass. Can you post the exact error and when you're getting it. Also, turn on policy logging: http://help.adobe.com/en_US/flex/using/WS2db454920e96a9e51e63e3d11c0bf69084-7ec4.html
With that, you can see if the file is being loaded, if it's being superseeded by another one, or roughly why it's being rejected.
In the meantime, some links that might be useful.
Cross-domain policy spec: http://www.adobe.com/devnet/articles/crossdomain_policy_file_spec.html (explains exactly what's going on behind the scenes)
Cross-domain maker: http://www.crossdomainmaker.com/ (easy policy file syntax)
Some security tips when dealing with cross-domain: http://www.adobe.com/devnet/flashplayer/articles/secure_swf_apps.html#articlecontentAdobe_numberedheader_3
Btw, setting a policy of "*" is a huge security hole.