I've been thinking in a couple of alternatives but couldn't find a perfect one that fulfills all of these objectives: single query, SQL only, multi replacements per post, all kinds of smileys get replaced (sad, angry, etc), it is as safe as possible and it is efficient.
Regarding safeness, I think that could be achieved by replacing based on the unescaped "<" in the "img" tag. That way nothing should be accidentally replaced. Considering MySQL's extremely poor regular expression support, the best approach I could think of is:
1. Fetch all posts that have smileys:
SELECT postid FROM ^posts
WHERE content REGEXP
'<img alt="[^\"]*" height="20" src="${PLUGIN_ROOT_URL}/plugins/smiley/images/[^\.]+.gif" title="[^\"]*" width="20">'
The "alt" and "title" attributes can be replaced with a set of the actual possible values but I don't think it is necessary. Also note there are matching "<" and ">" that should not allow false positives. The ${PLUGIN_ROOT_URL} is actually a fixed value for all posts and is calculated before running the select statement and used as a parameter.
2. Perform the appropriate string replacements using the decent regular expression functions from PHP. This is actually trivial.
3. Update each post one by one. This could be done in batch by executing the query you mentioned but still could result in false positives (the ones that have the false positive itself and also a smiley matched with the REGEXP.
4. I think the reindexing of post is not a big deal. I don't actually remember if what gets indexed is the html or just the text. I think it is just the text. Anyway, in the awkward case in which the HTML attributes get indexed too then there is a single flag to set in the DB migration that automatically performs the reindexing after executing the query.
The other approach, the unsafe one, is to execute your query. Anyway, although it is unsafe, I don't think many forums are actually pasting that string in posts (only this one or maybe ckeditor's ones). So I think it wouldn't be THAT bad to merge your query with the matching results in item #1 decreasing the chance of errors. The error would be adding "/ckeditor" in a comment text that contains the src="${PLUGIN_ROOT_URL}/plugins/smiley/images/ string and also happens to have at least a smiley from v1.6.3 and below.
That's all I can think of.