A regex should be inside forward slashes, with backslashes to escape special characters like the question marks:
var pattern = /\? string:([a-zA-Z0-9-]+) \?/;
I've replaced the underscore (_) with a hyphen (-) to match that inside the GUID, and added the "+" at the end to match at least one character.
value.match(pattern)
will return an array containing the full string and the GUID.