I don't think that's technically a bug.  Anyway, if I understand *RFC 6749* correctly, that is not how you are supposed to do such extra checks.

**Use [the `state` parameter][1].**  And this works.

For example, a call to:  
  [`/oauth/dialog?...&state=robfoo&redirect_uri=https://stackexchange.com/oauth/login_success`][2]  
(Click the link and try it.)

<br>
Yields results like:  
&emsp; `https://stackexchange.com/oauth/login_success#access_token=Qs...LUg))&state=robfoo`


When the user authorizes the app.

  [1]: https://tools.ietf.org/html/rfc6749#section-4.2.1
  [2]: https://stackoverflow.com/oauth/dialog?client_id=903&scope=no_expiry,read_inbox&state=robfoo&redirect_uri=https://stackexchange.com/oauth/login_success