It isn't terribly common, but it isn't terribly uncommon either. It's simply a way to do email validation without having to store extra state information.
So, it's simple, which has some benefits in that complexity is the enemy of security, so simple solutions are typically better for security than more complex alternatives that do the same thing.
HOWEVER...I would suggest that in this case, it is not only not better, but in fact less secure, and less than ideal.
The primary reason is that it is always a bad practice to send passwords in email. Even temporary ones. It's much better to send a link that lets the user set a password by following the link. This works for email validation, for accounts created asynchronously (by an admin, or a batch job, for instance) and password resets when a user has forgotten their password. This requires a bit of extra state as I mentioned before (the link has to be unique, and you have to remember the value for when the user clicks the link and returns) but this is not all for naught. It not only means that the password never need be sent out into the ether in plaintext, but it also gives you a single point (the token) to expire if it hasn't been used in a reasonable time, and to check to prevent re-use. (A single token should only work once.)
So, the link is decidedly more secure. Tokens are easier for you to protect with security controls than passwords, and you should never send passwords in plaintext, which begs for abuse and misuse.