It would expose your credentials the same way as if you entered them at the terminal on the compromised machine (eg. possibly not at all, but quite possibly). Although SSPI (especially Kerberos) is supported starting from RDP6.0, usually
mstsc does not obtain the kerberos ticket; it sends your keystrokes over the RDP connection (encrypted against the compromised machine's machine certificate), and the RDP server obtains the kerberos ticket.
If you want to make sure the server can't steal your password, you need to be certain you are using kerberos to authenticate over RDP. You could also use certificate-based (that is, smart card) authentication - but bear in mind that unless configured otherwise, RDP will pass through smart card auth in many cases.
Bear in mind, also, that stealing your credentials isn't the only threat here. No matter what, the target machine will at some point have your ticket-granting ticket on it, meaning that it will be able to perform actions as you for the validity of the ticket-granting ticket. This is basically session fixation. The compromised server could also just hijack your session.
In short, no, this isn't particularly safe.