Sending this on to wikitech-l so the devs can comment on it.
Replied on commons-l and fixed for default MediaWiki installations in r39203.
What did you fix? Nothing on the Wikimedia servers, right? Because I have now confirmed, that the applet can be made into originating from commons using Special:FilePath and it can connect back to commons (that involved uploading a new version of my gifar).
http://toolserver.org/~dschwen/test.html (the second applet loads user.gif from commons.wikimedia.org)