Source: seclists.org/bugtraq/2014/Jul/85
Sp. thanks to: blog.fefe.de/?ts=ad3707ae (german)
Apparently for paypal its not a bug to change the charged amount after(!) confirmation by the customer.
tl;dr from source:
**********************
Short description:
**********************
In PayPal Express Checkout the Online-Shop can transfer
any amount, no matter which amount the client actually
confirmed at the PayPal website.
If you are using Paypal allways check the mail. You can not rely on the information you see durring confirmation. Paypal does not even recognize this as bug.