That behavior is expected, and documented.

Perhaps you missed this in the docs (you did consult the docs, correct?):

       MIXING POST AND URL PARAMETERS

          $color = $query->url_param('color');

       It is possible for a script to receive CGI parameters in the UR
+L as
       well as in the fill-out form by creating a form that POSTs to a
+ URL
       containing a query string (a "?" mark followed by arguments).  
+The
       param() method will always return the contents of the POSTed fi
+ll-out
       form, ignoring the URL's query string.  To retrieve URL paramet
+ers,
       call the url_param() method.  Use it in the same way as param()
+.  The
       main difference is that it allows you to read the parameters, b
+ut not
       set them.

       Under no circumstances will the contents of the URL query strin
+g inter-
       fere with similarly-named CGI parameters in POSTed forms.  If y
+ou try
       to mix a URL query string with a form submitted with the GET me
+thod,
       the results will not be what you expect.
[download]