You can just enter the numbers of the ones that are still valid to get them automatically, yes. That's not particularly an exploit, though.