Nice find - you've noticed important threat. However on my Chrome (despite having autofill swithced on) your demo doesn't work.
The fun thing about this type of vulnerability is if you know the user's name, you can build an invisible form component to get the browser to spill the stored password.