It picks characters from the whole unicode range. Those strings should indeed match all regex constraints. You can add a constraint like:

    ^[\x21-\x7E]*$

To only choose printable ASCII characters.

EDIT: no you're right, there is a bug. I would expect random unicode chars but not always the same box.

Actually no again, I think the browser can just not render those.