It's still doing it and it can't be due to some local flash update, I have removed the "*" so Flash must always be explicitly allowed to run on per site basis. So to repeat that, it only pops up if the site uses flash, not every site. I did a quick check on the scripts with f12 and did not notice anything flash related.
As far as I'm concerned until better explanation comes up C9 is compromised and has some flash based drive-by attack so I'm not running it. 