I have discovered yet another bug in your "bash" program.
First we see how a normal program, trusty sed, deals with [ ]:
$ r=abaabbbbbdddd; echo $r|sed 's/[:?/ba]/u/g'
uuuuuuuuudddd
Now we try "bash":
$ r=abaabbbbbdddd; echo ${r//[:?/ba]/u}
abaabbbbbdddd
$ r=abaabbbbbdddd; echo ${r//[:?\/ba]/u}
uuuuuuuuudddd
Observe how a backslash is required, else the program doesn't "fire".
It's as if it is totally unaware that it is already inside the [ ].
And if the backslash was really required, then why doesn't it "blow up"
if we remove it?
While we are here, here's another interesting phenomena,
$ touch aa
$ echo a[ab]
aa
$ echo a[ab/]
a[ab/]
$ echo a[ab\/]
a[ab/]
$ mkdir ab #doesn't help...
