Since phpBB 3.3.6, the accept attribute was added to the file input.

posting_attach_body.html :

<input type="file" accept="{{ ALLOWED_ATTACHMENTS }}" name="fileupload" id="fileupload" class="inputbox autowidth" /> 

However, whatever the attachment settings, the value of that attribute has no effect for the basic attachment panel (used when plupload isn't working, as Javascript support is disabled). The reason is the value is invalid!

A dot is missing before each allowed extension.

For example, if the admin allows users to attach pictures and MP3 files, the accept attribute would have "gif,png,jpeg,jpg,tif,tiff,tga,mp3" as value, instead of ".gif,.png,.jpeg,.jpg,.tif,.tiff,.tga,.mp3".