Last time I checked, adwords failed to detect javascript injection from an obfuscated Flash creative.
That's the kind of things that we detect at ClarityAd via dynamic analysis.
Aren't people moving away from flash creatives yet?
Flash is still the standard for "rich media" ads, despite the lack of mobile coverage. HTML5 ads are growing fast but still very small.
No - AdWords is bidding on search and only allows text in ads. He is most likely using one of the less-policed RTB trading desks.