I think you might be thinking of locking up the browers, rather then crashing it. You can easily create a javascript program that will run a loop that will make your browser non-reactive.

But this is very different the plugin actually crashes. The security issues comes in to play because when the plugin crashes it is doing something it wasn't designed to do. So (in theory) someone malicious could take this crash and make the flash player do something specific it wasn't designed to do like run some code outside of it's sandbox. Which obviously would be a very big deal.

This is different then the lock up/DoS case where a product is doing what it is meant to do, but will just take a very long time (maybe forever) to finish it.