The only updated state information passed to the server is contained within the callback.  Thus you will need to pass any values you need in the single argument of the callback (delimited by some known character).  In the serverside code simply parse the single argument out into multiple ones.

Hopefully it is also obvious that any state information written during a callback will also not be persisted in the page, since it is not re-rendered.  Note:  this excludes Session state which would work if you chose to use it.

You could concatenate things directly like this...

this.cmdNext.Attributes.Add("onclick", ClientAPI.GetCallbackEventReference(this, "dnn.dom.getById('" + this.NSNext.ClientID + "').value + '~' + dnn.dom.getById('" + this.NSPage.ClientID + "').value", "nsNextSuccessFunc", "this", "nsNextErrorFunc"));

But I would probably code it like this...

and somewhere in the page (or separate js file) define

function mynicefunctionnamehere()
{
  return dnn.dom.getById('" + this.NSNext.ClientID + "').value + '~' + dnn.dom.getById('" + this.NSPage.ClientID + "').value;",
}

On the serverside you would parse the argument (i.e. arg.split("~"))

Note:  If you are unsure that the tilda (~) is a safe character you can use my predefined character for delimiting the string...

function mynicefunctionnamehere()
{
  return dnn.dom.getById('" + this.NSNext.ClientID + "').value + COL_DELIMITER + dnn.dom.getById('" + this.NSPage.ClientID + "').value;",
}

on the serverside the delimiter is found in the clientapi namespace.

arg.split(ClientAPI.COLUMN_DELIMITER)