Using a different URL after flow has started

[evilcouncil]

1. Access /app/user/pswd
2. Will be redirected to /app/user/pswd?execution=e1s1
3. Access /app/user/profile?execution=e1s1 (this is also a valid flow in my app)
4. Still see the same page. Subsequently, submitting the form will be successful.
5. Alternatively, use Fiddler2 to intercept form submission and POST to "/app/user/profile?execution=e1s1" instead. It still works.

Is this the expected result? With a valid "execution" value, should the application allow using of different URLs?

One of HDIV's feature is to prevent users from submitting the form with a different "action" value. Any advice is much appreciated.