Below is some sample code.
<body>
    <div id="wrapper" class="access">
        <form id="test">
            <input id="password"></input>
            <input type="submit"></input>
        </form>  
    </div>
    <script>
        console.log(password);
        alert(wrapper.className);
    </script>
</body>
The console log returns the DOM element with id password. The alert is "alert". 
It works in normal code as well, e.g. var x = wrapper.className; 
Surely this is not right? What is the point of document.getElementById, $('#password') or goog.dom.getElement if it just works like this? Are these functions just for legacy now? 
It works in Firefox, Chrome and Safari, incidentally.
 
     
     
    