Fixes #17

[jonaskohl]

This fixes an issue where the needle string would be used in a regex without escaping, thus yielding unexpected results

[cferdinandi]

Hi @jonaskohl - thanks for this!

The only change I'd suggest is removing the function abstraction and include the String.replace() function write in the new RegExp() constructor.

return this.replace(new RegExp(str.replace(/[.*+?(){}^$|[\]\\]/g, '\\$&'), 'g'), newStr);