This worked in 3.5.8.2.
Based on the current QA_4_4, I believe that there are two causes for this:
some scripts under /setup looking at $_GET instead of $_POST
using header('Location...') under /setup which is missing the token, therefore clearing the page parameter
Fixed with https://github.com/phpmyadmin/phpmyadmin/commit/1257f2c7144b70065d01f08c496a5266b57226e3