Yes, it's exactly the equivalent of someone finding a bug with the auto-password fill functionality in Chrome or Firefox or IE to trick the browser into filling in a password on an unrelated site.