I receive the same error.
I create a Sys Admin user and a standard user. For every user I run through the process of creating every object: From Account over Contact, Opportunity and Attachment. The Attachment is the one I want to test on and it is also the one throwing the error.

Generally the idea is that if an opportunity is in certain stages, certain profiles should no longer be able to:

• edit fields (controlled by Page Layout & record type)
• insert / update / delete (/ undelete) Attachments, Line Items and records of a custom object.

This is my test class. I use Constructor-like classes for my most used Objects in SF ("%Creator") which return a list<sObject> each.
Over a custom permission I grant the right to bypass the restriction I'm testing (and trying to catch with the "FIELD_CUSTOM_VALIDATION_EXCEPTION"). Accounts, Opportunities, Contacts, etc. have OWD private:

static testMethod void attTestInsert()
{
	System.assert(UserCreator.setProfile('System Administrator'));
	list<User> users = UserCreator.getUsers(1, 'admin');
	System.assert(UserCreator.setProfile('Personal'));
	users.addAll(UserCreator.getUsers(1, 'personal'));
	System.assert(UserCreator.setProfile('Kundenbetreuung'));
	users.addAll(UserCreator.getUsers(1, 'clientconsultant'));
	System.assert(UserCreator.setProfile('Sales'));
	users.addAll(UserCreator.getUsers(1, 'sales'));
	
	PermissionSet oppStagePerm = [ SELECT Id FROM PermissionSet WHERE Name = 'Opportunity_Stage_Permission' LIMIT 1 ];
	list<PermissionSetAssignment> oppStagePermAss = new list<PermissionSetAssignment>();
	set<Id> assignees = new set<Id>();
	
	System.runAs(new User(Id = UserInfo.getUserId()))
	{
		insert users;
		for ( User u : users )
		{
			if ( u.UserName.contains('personal') || u.UserName.contains('admin') )
			{
				oppStagePermAss.add(new PermissionSetAssignment(AssigneeId = u.Id, PermissionSetId = oppStagePerm.Id));
				assignees.add(u.Id);
			}
		}
		insert oppStagePermAss;
	}
	
	map<String, Id> recTypeMap = ArcUtil.getRecTypeMap('Opportunity');
	
	for ( User u : users )
	{
		System.runAs(u)
		{
			Account acc = AccCreator.getAccs(1, 'oppStageProtection_Acc').get(0);
			System.assert(AccCreator.setRecType('Event'));
			Account aFair = AccCreator.getAccs(1, 'oppStageProtection_Fair').get(0);
			insert new list<Account>{ acc, aFair };
			
			Contact con = ContactCreator.getContacts(1, 'Cave', new set<Id>{ acc.Id }).get(0);
			insert con;
			
			OppCreator.setOwner(u.Id);
			list<Opportunity> opps = OppCreator.getOpps(5, 'oppStageProtection_goOpp', new set<Id>{ acc.Id } );
			OppCreator.setConditional(true);
			OppCreator.setBarterContact(con.Id);
			OppCreator.setForTheAttentionOf(con.Id);
			OppCreator.setPartner(aFair.Id);
			OppCreator.setRecType('yes Opportunity');
			OppCreator.setStage('yes new');
			opps.addAll(OppCreator.getOpps(5, 'oppStageProtection_yesOpp', new set<Id>{ acc.Id }));
			insert opps;
			set<Id> oppIds = new set<Id>();
			for ( Opportunity opp : opps )
			{
				oppIds.add(opp.Id);
			}
			
			list<Attachment> atts = AttCreator.getAtts(2, 'oppStageProtection_Att', oppIds);
			
			if ( !assignees.contains(u.Id) )
			{
				try
				{
					insert atts;
				}
				catch(System.dmlException e)
				{
					System.assert(e.getDmlType(0) == StatusCode.FIELD_CUSTOM_VALIDATION_EXCEPTION);
				}
				finally
				{
					for ( Opportunity opp : opps )
					{
						opp.RecordTypeId = recTypeMap.get('go Opportunity');
						opp.StageName = 'go to be contacted';
						opp.OwnerId = u.Id;   // Does not have influence on the error appearing.
					}

                    // Does not have influence on the error appearing.
					System.runAs(users.get(0)) // users.get(0) is a System Administrator
					{
						System.assert(users.get(0).UserName.contains('admin'));
						update opps;
					}
					
					insert atts;
				}
			}
			else
			{
				insert atts;
			}
		}
	}
}

The error is thrown in the "finally" block with the "insert atts" statement. This block I only have to make a test that should succeed because the prerequisites are present.

The idea of the if-else block around the try block is, if the user has the custom permission, he can safely insert the attachments without fearing any errors (does work), while users without the permission should receive the error message (works as well). After that error message I want to adjust the conditions under which the user inserts the attachments by setting it to a "go Opportunity" and a go-stage.

Any hints appreciated.