[jazoom]

But then the browser won't autofill it, so what's the problem?

[sharkoz]

It will if the attacker uses the same custom name for his field. The attacker could try to suck as much data as possible by creating thousands of hidden fields having a lot of possible combinations for the names of these non-standard CC fields, and wait to get lucky.