CORS doesn't require preflight requests for simple GETs and POSTs, since you can always trigger those anyway. The browser can just do the request and check the headers on the response.
Wouldn't doing this on POST be dangerous? POSTs are not expected to be idempotent, so you're trusting the server to understand and check the Origin header etc.
You can send POST to any server using a JS-submitted form so it doesn't introduce new attack vector.
You get slightly more power in that you can post malformed multipart stuff.