This is correct, though you could cause a flood of requests that block input from the real user (each has to be dismissed in order).