The square brackets are technically correct, but unneeded:
str = str.replace(/\n/g, "<br>");
Also, since a new string is returned, you can chain the methods:
str = str.replace(/\n/g, "<br>").replace(/\t/g, " ");
For more information, you can read the MDN pages on replace and regular expressions.
Though the above is one line, if wanted to combine it into one replace, you could, but in my opinion this is uglier and less clear:
str.replace(/(\n|\t)/g, function (s) { return (s === "\n" ? "<br>" : " "); });
This could be useful though if you had a large set of simple replacements:
var map = {"\n": "<br>", "\t": " "};
str.replace(/(\n|\t)/g, function (s) { return map[s]; });
The idea could be extended farther to automatically generate the regex instead of relying on changing it every time map
is updated.