JSON order matters for parsing?

I can confirm that attachments work now with 3.6.2 for slash commands!
That means the whole workaround with the incomming webhook is not needed any more.
Slash commands can be used also in private messages, so this should work fine.