The crossdomain.xml that Twitter has on their site is:

<?xml version="1.0" encoding="UTF-8"?> 
<cross-domain-policy xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xsi:noNamespaceSchemaLocation="http://www.adobe.com/xml/schemas/PolicyFile.xsd"> 
  <allow-access-from domain="twitter.com" /> 
    <allow-access-from domain="api.twitter.com" /> 
    <allow-access-from domain="search.twitter.com" /> 
    <allow-access-from domain="static.twitter.com" /> 
    <site-control permitted-cross-domain-policies="master-only"/> 
  <allow-http-request-headers-from domain="*.twitter.com" headers="*" secure="true"/> 
</cross-domain-policy>

So unless you access http://twitter.com from a Web player that is hosted from http://twitter.com, http://api.twitter.com, http://search.twitter.com or http://static.twitter.com (or *.twitter.com), it simply won't work.

So, what you'll have to do to access Twitter from a Web player is to write a Web service that reads the data for you, hosted on your own server. Then, on that server, you can provide access via a crossdomain.xml that has your Web player location in the "allow-access-from"-list.

This is related to the new security model that was added to Unity 3.0. You can read more about it here: http://unity3d.com/support/documentation/Manual/Security%20Sandbox.html

Basically in order for you to be able to access a resource on a server via Unity (in your case http://twitter.com), that server's crossdomain.xml would have to specify an all access '*' in order for the request to be successful via Unity.