Servers aren't free, but they can be rather affordable.
As for Bandai suing; That is a possibility, but if you look at all the private WoW servers out there, you can see that the likeliness of that might not be too high, it all depends on how serious Bandai is about keeping illegal private servers off the web. If they're anything like Disney, then no one should bother.
My boyfriend could probably host a private server if he got a hold of all the coding and what-not, but he probably wouldn't want to take the risk of being sued.
The SWF is locked, and locked for a good reason. You could get sued by the artist and site designers.
Not to mention, as far as I can tell, they're hosted on Godaddy.