[Analogpoint]

Did you try doing an unserialize on the serialized data before other manipulations such as the str_replace?

EDIT:
Also, mysql_query returns a MySQL "resource", you should pass it to one of the functions such as mysql_fetch_assoc to return a php array of the data.

PHP Code:

<?php
$link = mysql_connect('localhost', 'dbname', 'dbpassword');
if (!$link) {
   die('Could not connect: ' . mysql_error());
}
echo 'Connected successfully'.'<br />';
$result = mysql_query("SELECT field10 FROM vbulletin.vb_userfield WHERE userid='3531'");
if (!$result) {
   die('Invalid query: ' . mysql_error());
}
echo 'Result resource<br />';
var_dump ($result);

echo 'Result array<br />';
$result = mysql_fetch_assoc ($result);
var_dump ($result);

echo 'Result unserialized<br />';
$result = unserialize ($result['field10']);
var_dump ($result);

echo 'Result quotes replaced<br />';
$result = str_replace( "&quot;", '"', $result);
var_dump ($result);

?>