The thing I use lsof for most often these days is watching Flash videos with mplayer (or VLC if you prefer). This allows me to pause/rewind/fullscreen easier. Or sometimes I save the file to watch later. You still have to start the video from within Flash and then pause it so it downloads the video file. Then you can do this:

    $ lsof | grep Flash
    plugin-co 1038   naner   16w   REG   254,2  4442164 7602188 /tmp/FlashXXfHeQqB (deleted)
    $ mplayer /proc/1038/fd/16

Oftentimes the output will give you duplicates for the same temporary flash file (FlashXXfHeQqB in this case) with an extra number after the process id, you can ignore all of that. I'm assuming those are child processes. All you need is the process id (1038) and the file descriptor (16). You can safely ingore the character (w) after the file descriptor.

Back in the day (Flash 9 or so?) the flash player used to just dump temporary flash video files in /tmp and delete them after you close the browser tab. I guess they figured it was too easy to copy the files out of /tmp so the newer flash player deletes the /tmp file immediately after it creates them. This is why we have to go and grab the open file descriptor.

This will work with most but not all websites. Some websites (Hulu) will use a streaming protocol (rtsp) among other things to make the content harder to get at outside of flash.

This works on Linux, I'm not sure about OSX or BSD.