This question already has an answer here:
Is it really a problem if you send back the password when the validation fail on a registration form?
I understand that the html that is sent back could be cached on the computer of the person registering and then if a malicious person later access that computer he could see the password that user entered by looking into his cached files.
BUT... Aren't you already screwed when someone get physical access to your computer? If he can look at the cached files of your browser chances are that he could install any program he wants on the machine. Also, many people store their password directly in their browser without a master password. If he has access to the computer he could just check all the passwords that the user saved.
EDIT : This is a similar question : https://ux.stackexchange.com/questions/20418/when-form-submission-fails-password-field-gets-blanked-why-is-that-the-case