Opened files can be listed using the lsof utility. Deleted ones are shown like this:
# lsof COMMAND PID TID USER FD TYPE DEVICE SIZE/OFF NODE NAME [...] plugin-co 6640 n0-1 17r REG 254,1 10279214 2621682 /tmp/FlashXXcHpDke (deleted) [...]
in order to recover it, one can use the procfs entry for that open fd:
# ls -l /proc/6640/fd/17 lr-x------ 1 n0-1 n0-1 64 May 30 23:47 /proc/6640/fd/17 -> /tmp/FlashXXcHpDke\ (deleted)
retrieving it is as easy as eatin' pancakes:
# cp /proc/6640/fd/17 /tmp/FlashXXcHpDke.flv