What is the problem?
Using the GUI at Devina.io (as the Playground appears to be down), a regex with large bound quantifiers such as [a-z0-9]{2000,} currently generates artificial attack strings like '00000000' + '00000000000000000000000000000'.repeat(29) + '000000000000000000000000000' + '0000000'.repeat(27) or '00000'.repeat(352) + '000000000000000000000000000000000' and gets reported as polynomial.