This attack wouldn't work. Scanning a QR code which goes to a non-WeChat URL will flip to WeChat's built-in browser, which looks very different from the payment dialogue box.

In any case, how are QR codes different from text URLs? Do you check the destination of every web link and/or button before clicking? Do you disable JS so that you can be sure that the URL displayed in the status bar isn't different from the one which will really be launched?