@rovf, passing environment variables is an interesting alternative, but is not needed here because the expect script is prepared in the shell.
In detail, the shell substitutes the shell variables by their values, writes the result to the here document, and then passes it to the expect program as stdin.
Good point. However, this approach is dangerous, Imagine the effect if someone decides to change the password to
[error HaHaHa]
or some even nastier string. I would really avoid shell interpolation into a Tcl program unless I can be absolutely sure that the interpolated code does not ruin by Tcl code.