I assume a real attack wouldn't use <input type="hidden" />. Instead, you'd style the input such that the user doesn't see it, but the browser thinks it's visib

I assume a real attack wouldn't use <input type="hidden" />. Instead, you'd style the input such that the user doesn't see it, but the browser thinks it's visible. Extremely low opacity and/or an incredibly small size could do the trick. To provoke the browser into autocompleting data, you might even be able to use JavaScript to fake keystrokes in the stealth form inputs. Front-end stuff is well outside my area of expertise, so I'm betting someone already tried these ideas and now browsers protect against them.