I don't have a Galaxy S3 to test this, but my experience with the Galaxy S and Galaxy S2 is that for normal phone numbers, you need to specifically confirm that you want to dial the number. For the code to factory reset the phone, though, simply typing in the code is sufficient, you don't need to press dial. It might be the same here, so that only that specific USSD code can be triggered without a confirmation from the user.
Yes, this is how it works. I tested a Galaxy S2 and HTC with Chrome and the stock Browser - both spawn the dialler and pass the code which triggers automatically on the terminating '#'.
