Ran into an issue where certain password characters would cause this …

[dmmueller]

…to fail and expose the passwords in the logs.

[Callisbot]

The issue is that send will read the ${userPass} variable as a flag if it begins with certain characters. I managed to fix this by adding -- before the variable.

send -- \"${userPass}\"

Quote from the expect man page: "The -- flag forces the next argument to be interpreted as a string rather than a flag."