Blind guessing, since I can't know for sure without the code and some test cases:
That regular expression only catches instances of [:)] and [;)] that are either surrounded by whitespace, or are at the beginning or end of a string. That's what (?:\s|^) and (?:\s|$) mean. It will not match Hello[:)]World, possibly by design. Is that the sort of case you're testing it on?
EDIT: Got it. Because of how the regular expression is written, by testing for spaces on either side, it includes those spaces in the match. Those matches can't overlap. If you were to separate them with two spaces, you would see intended behavior.
If you don't care about it not running up against words, your job with that regex is extremely simplified: escape the emoticons, then join them with |, to produce /\[\:\)\]|\[\;\)\]/.
This might be a better place to just use str_replace a few times, though.