How can I have ClickToFlash except for YouTube?
bmike's comment prodded me into actually, y'know, reading the manual, which led me to find that the whitelists are in fact substring matches. Therefore these settings work:
I had to find the /v/ URL by looking at the source of a page with a YouTube embedding.