You can search for "Click to play" in the settings and disable plugins until you click on them. This helps a little security-wise, too, in case an attacker is resourceful enough to have both a 0-day for Flash and the Chrome sandbox. Not sure how likely that is, but it's also trivial to white-list sites you trust not to send you exploits from the icon in the URL box.