I was provided a custom patch from Magento for this issue, that fixes it for EE 1.14. The only change that I think would be necessary is taking out the check for Enterprise_Pagecache, which I have done in the code below.
The solution is to add an event observer in a local module like the following:
// Model/Observer.php
...
public function replaceFormKeyForWishlistAdd(Varien_Event_Observer $observer)
{
$formKey = Mage::getSingleton('core/session')->getFormKey();
$session = Mage::getSingleton('customer/session');
$beforeWishlistRequest = $session->getBeforeWishlistRequest();
$beforeWishlistRequest['form_key'] = $formKey;
$session->setBeforeWishlistRequest($beforeWishlistRequest);
$newBeforeAuthUrl = Mage::getUrl('wishlist/index/add',
array('product' => $beforeWishlistRequest['product'], 'form_key' => $formKey)
);
$session->setBeforeAuthUrl($newBeforeAuthUrl);
return $this;
}
...
.
// etc/config.xml
...
<events>
<customer_login>
<observers>
<namespace_module>
<class>namespace_module/observer</class>
<method>replaceFormKeyForWishlistAdd</method>
</namespace_module>
</observers>
</customer_login>
</events>
...
Here is the patch, which makes these changes in the core: https://github.com/timciep/magento-tools/tree/master/Patches/SUPEE-10123_EE_1.14.0.1_v1.