The whole reason of this type should be to prevent the user from even entering/pasting non-number data.
But you can add @$%<6 all sorts of characters. What's worse, on Win8.x the softkeyboard does not (like in the dev preview) show you an numbers only panel like the one shown when you need to enter the pin at the startscreen.
And then, you cannot combine the number field type with a pattern. Yikes. Is that really what the W3C came up for usability?