Even when autorun is disabled, Windows will parse through the autorun.inf file. This should have been patched with KB967715. U3 enabled devices have been known

Even when autorun is disabled, Windows will parse through the autorun.inf file. This should have been patched with KB967715. U3 enabled devices have been known to override the default settings in order to emulate CD-ROM drives. Double clicking the flash-drive icon can also force execution of binaries, but I am unsure of how that works and if it is related to the user's autorun settings or not.