So far I've found out that the Dynamic Property popup actually loads an url within an iframe: /episerver/CMS/Edit/EditDynProp.aspx?moduleArea=LegacyCMS&id=1234&IsInLegacyWrapper=true
When trying to access the URL directly, I get the same result as in the modal popup, the startpage is shown. 

Fiddler does not show any redirects, only a 200. EPiserver log shows nothing of interest (with debug-flag enabled).

I think there is some routing going on. If I use a non-existing Page ID in the query string (or remove the query string all together) I am able to see the "normal" dynamic properties for the startpage.

I tried making a copy of EditDynProp.aspx and copied the code-behind from EPiServer.UI.Edit to do do some debugging.
Then I put a couple of breakpoints in the OnLoad and OnInit methods. What's strange is that my breakpoint are never hit when the URL contains the query strings. Without them the breakpoints are hit though.

I found the cause.

We put this in to deal with classic urls, I guess it conflicts with the dyn.prop window as well. Removing it solved it for me.

Global.asax.cs

        protected override void RegisterRoutes(System.Web.Routing.RouteCollection routes)
        {
            base.RegisterRoutes(routes);
            routes.Insert(0, ServiceLocator.Current.GetInstance<ClassicLinkRoute>());
        }