Although there is a bit wrong in the flow, but it still can get private token successfully.

Correct flow is: when you get the token, it will auto redirect back where you come from (usually github).
I think Firefox force using a new tab to open url causes the error.