This problem is occuring because + is a special character in regular expressions (it matches one or more of the character that preceeded it). For a simple replacement like this you are much better off using str_replace because it doesn't involve the overhead that a regular expression match does.
Simply try:
str_replace ('+', '&', $string);
See the manual for str_replace.
Louis