There could be a ClickToFlash version not loading Flash objects at all until requested couldn't there? Of course it would probably be for all <embed> and <object>, but...
That's the core functionality of NoScript: don't allow anything more complicated than HTML+CSS until authorized by the user. It blocks objects but by default leaves behind a rectangle you can click to download and run the object.