The non-SSL download incurs the theoretical (and also practical) risk of being intercepted by an active attacker, who will make "something else" with it.
Javascript, by itself, cannot do downloads from outside of its own domain; that is the point of the Same-Origin Policy. Since the Javascript is loaded from the bank domain (foo.com) but the download is from l.longtailvideo.com, then one must assume that the Javascript instructed the browser to do the download, most probably by inserting an <img> tag in the page HTML.
Browsers are, generally speaking, quite well protected against malicious pictures; otherwise, you would get hacked when you do Google searches or access various forums, because in many forums one can embed links to external pictures.
In your case, the picture is the logo for a video player in Javascript/Flash (depending on what the browser can do); I think it is this one, although maybe an older version because their logo appears to have changed. This blog post indirectly tells us that the player with the logo you observe was the "latest version" more than two years ago.
What is the worst that could happen ? I suppose that the logo is displayed somewhere on the page. An industrious attacker could replace the logo contents with a picture of his own, possibly a bigger picture which would disrupt the page layout.
There are worse things, though. The attacker could return a HTTP "redirect" to make your browser send a GET request to any arbitrary other URL. You will probably find this past question interesting: it discusses what could happen with an <img> tag pointing to an attacker-controlled server. That applies to your case.
Anyway, the mere fact that your browser warns you is a bad thing: either the warning is important, and that's a security alert which should be treated as such; or the warning is spurious, and it trains the user into ignoring security warnings, which is not good at all in the long term.
