Just posting this to help others out. This bug may be related to my use of SIDKiller contribution as well, which heavily modifies tep_href_link, but not sure.
Express Checkout ReturnURL was acting incredibly strange, if you passed a URL with multiple query string variables it would strip the & in the return.
Example URL passed:
http://yoursite.com/catalog/shopping_cart....osCsid=whatever
after entering the info in PayPal and hitting Continue it would redirect me to...
http://yoursite.com/catalog/shopping_cart....heckoutwhatever , with the &osCsid= completely removed.
-----------
So to make Express Checkout work I modified: /catalog/includes/modules/payment/paypal_wpp.php a bit.
Around line 582 or so, I changed this code:
$order_info['PAYPAL_RETURN_URL'] = tep_href_link(basename($_SERVER['SCRIPT_NAME']), 'action=express_checkout', 'SSL');
to
//$order_info['PAYPAL_RETURN_URL'] = tep_href_link(basename($_SERVER['SCRIPT_NAME']), 'action=express_checkout', 'SSL');
$temp_return_link = tep_href_link(basename($_SERVER['SCRIPT_NAME']), '', 'SSL');
$order_info['PAYPAL_RETURN_URL'] = $temp_return_link . '&action=express_checkout';
and it Express Checkout then worked. Hope this helps someone as this was confusing me for like 6 hours.