I have made an intensive research and found some solutions. The conclusion made by Mathieu's (that google changes arguments and you have to write your own app) is wrong. The problem is that google checks for cross-domain access. It is not regulated via Adobe Flash player crossdomain.xml as in this case, surprisingly. Flash player doesn't attempt to load that file from server root directory (tested in Firebug).
The problem is that google is checking for referer, and if that is set, it refuses to load the content, please check:
So the problem boils down to referer spoofing for inline content.
Solution 1 - RefererKiller
You can use a simple trick: refer to the mp3 file in <img src="">
tag, see my example, with added referer spoofing. Then the flash player will not have to download it, since it will be in cache already. There are solutions to remove referer from inline content (see RefererKiller implementation for images). However, comment suggests the cross-browser compatibility might be an issue.
Solution 2 - https
So, the simplest solution is to use https
protocol - clear your cache and try the above link with https added. Referer will not be set for inline content. But, if you don't have trusted certificate, you probably don't want your users to go through the terrible 4-click process to confirm the trust in your certificate. In that case, you probably want go for another solution.