The & is fine if it's in a hidden input (I think maybe the browser decodes it before submitting?) but not OK to use in an ad_returnredirect. But I'm not sure why you're redirecting if you're using the bulk actions... Bulk actions adds a link to the form that calls Javascript that does a form.submit, no?
