Fear of this sort of thing is why many larger corporations are locking out USB drives as part of group policy updates. They will never disable autorun, but by gosh, they'll make it so you can't plug any sort of USB device in.

There have been several stories of people tossing trojaned USB "thumb drives" into parking lots at large companies in order to get their payload installed, and it works. This is a fatal flaw of autorun.