I can confirm that I just updated from 5.2.16 to 5.3.7 and have the same error. A look at the source shows the urls as having the url ../dl.php which of course is sending the request down on level.
<input type="button" value="Printable Version" class="button" onclick="window.open('../viewinvoice.php?id=13312','windowfrm','menubar=yes,toolbar=yes,scrollbars=yes,resizable=yes,width=750,height=600')" />
<input type="button" value="View PDF" class="button" onclick="window.open('../dl.php?type=i&id=13312&viewpdf=1','pdfinv','')" />
<input type="button" value="Download PDF" class="button" onclick="window.location='../dl.php?type=i&id=13312'" />
Has a fix been released or is this in a template we can edit?
Regards
Shane