the client side regex validation behaves inconsistent between the 2 cases
a) using the attribute

<textbox id="textbox1" constraint="/^([0-9]{1,3}(,[0-9]{1,2})?)?$/:myMsg"/>

b) adding a constraint programmatically

textbox2.setConstraint(new SimpleConstraint("^([0-9]{1,3}(,[0-9]{1,2})?)?$", "myMsg"));

in case a) the constraint string is parsed on the client side into a JS RegExp with the global flag
see: https://github.com/zkoss/zk/blob/master/zul/src/archive/web/js/zul/inp/SimpleConstraint.js#L72

/^([0-9]{1,3}(,[0-9]{1,2})?)?$/g

in case b) the constraint is created directly as (not global)
see: https://github.com/zkoss/zk/blob/master/zul/src/archive/web/js/zul/inp/SimpleConstraint.js#L44

/^([0-9]{1,3}(,[0-9]{1,2})?)?$/ 

(no 'g' in the end)

this leads to inconsistent matching behavior later when the regex is used to validate the input value here:
https://github.com/zkoss/zk/blob/master/zul/src/archive/web/js/zul/inp/SimpleConstraint.js#L226

the differences between global and non global regex's are documented e.g. here
https://developer.mozilla.org/en-US/docs/Web/JavaScript/Reference/Global_Objects/String/match#Description

This problem happens when the regex contains capture groups, that result in multiple matches for non-global regular expressions.

The attachment contains shows the problem and contains a possible workaround (currently commented out).