The following code, pulled from YouTube's classic embed code (non iFrame) with "youtube.com" replaced with "notonlist.com", when run through the embed filter, only removes the "embed" tag, but not the "object" tag. This allows the video to be loaded in Safari, but not FF.

<object width="640" height="390"><param name="movie" value="http://www.notonlist.com/v/VvJ037b_kLs?fs=1&amp;hl=en_US"></param><param name="allowFullScreen" value="true"></param><param name="allowscriptaccess" value="always"></param><embed src="http://www.notonlist.com/v/VvJ037b_kLs?fs=1&amp;hl=en_US" type="application/x-shockwave-flash" allowscriptaccess="always" allowfullscreen="true" width="640" height="390"></embed></object>

The values passed through embedfilter_process after the preg_replace_callback are as follows for the two tags:

Array
(
    [0] => <object width="640" height="390"><param name="movie" value="http://www.notonlist.com/v/VvJ037b_kLs?fs=1&amp;hl=en_US"></param><param name="allowFullScreen" value="true"></param><param name="allowscriptaccess" value="always"></param><embed src="http://www.notonlist.com/v/VvJ037b_kLs?fs=1&amp;hl=en_US" type="application/x-shockwave-flash" allowscriptaccess="always" allowfullscreen="true" width="640" height="390"></embed></object>
    [1] => object
    [2] =>  width="640" height="390"
    [3] => <param name="movie" value="http://www.notonlist.com/v/VvJ037b_kLs?fs=1&amp;hl=en_US"></param><param name="allowFullScreen" value="true"></param><param name="allowscriptaccess" value="always"></param><embed src="http://www.notonlist.com/v/VvJ037b_kLs?fs=1&amp;hl=en_US" type="application/x-shockwave-flash" allowscriptaccess="always" allowfullscreen="true" width="640" height="390"></embed>
)
Array
(
    [0] => <embed src="http://www.notonlist.com/v/VvJ037b_kLs?fs=1&amp;hl=en_US" type="application/x-shockwave-flash" allowscriptaccess="always" allowfullscreen="true" width="640" height="390"></embed>
    [1] => embed
    [2] =>  src="http://www.notonlist.com/v/VvJ037b_kLs?fs=1&amp;hl=en_US" type="application/x-shockwave-flash" allowscriptaccess="always" allowfullscreen="true" width="640" height="390"
    [3] => 
)

The code in embedfilter_process calls embedfilter_approve($input[2]), which in the first case, will always be approved (since it does not contain any src/href/data). I've been trying to figure out a fix, but am currently stumped. Anyone have any ideas?