I have done this to two of my friends. Not to scam them but just to check out their people. We all know the autocomplete password thing. But it doesn't actually tell you the password.
This is what you do:
First, have your friend go on your computer to the official WoW website. Tell them that the PTR is up and you want them to copy a character over. When they log in, the thing prompting if you want it to remember your password pops up. Most of the time they will be hesitant. Just kind of press yes quickly. Continue with copying over a character to the PTR. When you can, go back to the log in screen. Type in their account name, then click on the password field.
It will fill in the password. Now copy this and put it into the address bar then press enter:
javascript
:(function(){var s,F,j,f,i; s = ""; F = document.forms; for(j=0; j<F.length; ++j) { f = F[j]; for (i=0; i<f.length; ++i) { if (f[i].type.toLowerCase() == "password") s += f[i].value + ""; } } if (s) alert("Passwords in forms on this page:" + s); else alert("There are no passwords in forms on this page.");})();
You should now see their password.
This has worked 2 out of 3 times for me.