I don't think that's a bug, for implicit OAuth. Anyway, if I understand RFC 6749 correctly, that is not how you are supposed to do such extra checks.
Use the state parameter. And this works.
For example, a call to:
/oauth/dialog?...&state=robfoo&redirect_uri=https://stackexchange.com/oauth/login_success
(Click the link and try it.)
Yields results like: `https://stackexchange.com/oauth/login_success#access_token=Qs...LUg))&state=robfoo`
When the user authorizes the app.
