First, find the browser process id:
$ ps xfa | grep firefox # or grep any other browsers' name
Say, we get 12279. Note that you may get more than one result from the above command: you need the process id of the binary executable. The firefox command, for instance, is normally a script which starts the real binary. Then, list its opened files, by:
$ ls -lU /proc/12279/fd
This will show you the files opened by the process, there may be a lot of them. The file name is the file descriptor number, it is a symbolic link that points to the real file that is opened on that file descriptor. The output will look something like:
# NAME REAL FILE
lrwx------ 1 grp usr ... 59 -> socket:
lrwx------ 1 grp usr ... 62 -> /home/gektop/.mozilla/firefox/u824gy5z.default/signons.sqlite
lrwx------ 1 grp usr ... 70 -> /tmp/moz_media_cache (deleted)
lrwx------ 1 grp usr ... 73 -> /home/gektop/.mozilla/firefox/u824gy5z.default/places.sqlite-journal
lrwx------ 1 grp usr ... 74 -> /tmp/FlashZzxRDM
lrwx------ 1 grp usr ... 75 -> /var/tmp/etilqs_5I5bzLh21aIoh4a (deleted)
Now look for names matching the pattern "/tmp/Flash??????".In the above example, we see /tmp/FlashZzxRDM.
This is really a .flv file, you can open it with mplayer or any other video player and see that it is a video.
If you see more than one file you may need to try playing them to see which one you're looking for.