The redirect was successful, directing tab B to an authenticated page within the web application.
Later in the day at home, I decided to play around and see what other sites are vulnerable to this as it struck me as something that is probably frequently overlooked and testing it causes no harm to the webpage (i.e. I am not trying to SQL inject them or do any damage). Attempting such a redirect on a non-authenticated tab with a separate tab already authenticated was successful on multiple sites, a few seeming to be a little too important to allow such a vulnerability.
Is this really a CSRF vulnerability? Or is this simply overlooked by owners of websites and web apps since these requests are all GET requests but an attempt to do a POST might be rejected as that would symbolize a true CSRF vulnerability?