you're missing a crucial detail here which is the means whereby .+? stops matching. once an extra character has been consumed, the engine tries to match the rest of the expression, in this case ]. there is extra overhead involved in this approach, and the difference becomes apparent in the following tests:

alias speedcheck {

  ;var %a = $str(abc,100)
  var %a = $str(aaaaa[ $str(b,30) ]cccc,10)
  ;var %a = [[ $str(abc,100) ]]

  var %b = 20000
  !var  %t = $ticks 
  while (%b) { 
    !noop $regsubex(%a,/\[.+?\]/g,) 
    !dec %b 
  } 
  !var %c = $ticks - %t 

  var %b = 20000
  !var %t = $ticks 
  while (%b) { 
    !noop $regsubex(%a,/\[[^]]+\]/g,) 
    !dec %b 
  } 
  !var %d = $ticks - %t

  echo -a First method: %c ms -- Second method: %d ms

}

.+? is a construct that, in general, describes languages that aren't strictly regular. our intuition should tell us that if we can use a regex that can be converted into a DFA (http://en.wikipedia.org/wiki/Deterministic_finite_state_machine) then it should be preferred to one that cannot. as you correctly stated, the byte size of the regex has little to do with its performance