I couldn't run your code (seeing as you didn't post it all) so I wrote my own version for testing. I can't reproduce your results using FF2.

<form name=test action=test.cgi method=get>
   <select name=ordertype id=ordertype onchange="
      document.getElementById('orderparams').innerHTML = (
         '<input type=text name=duration>'
      );
   ">
      <option value=halt>Halt
      <option value=attack>Attack
      <option value=capture>Capture
      <option value=move>Move
      <option value=rest>Rest
      <option value=wait>Wait
   </select>
   <div id=orderparams></div>
   <div><input type=submit value='Issue Order'></div>
</form>
[download]

After changing the value of the SELECT, putting a foo in the text box that appears and pressing the submit button, FF requested the URI

.../test.cgi?ordertype=move&duration=foo
[download]

Does the above work for you too?

Note, the HTML was a local file (file:// scheme). That might make a difference.