Grr, with some content this time $ff = "CONCAT($flagtypes.name, $flags.status)"; we should instead be able to split the last entry from the string, check that its +/-/?, and then match separately. Thats got to be faster, since we can then use an index. This may be hard in general (ie substring), but we can at least simply equals/notequals/anyexact/etc, which would be by far the most cmmon type of search, I'd guess. Alternately, we could split up the flag stuff, requiring two entries in teh boolean chart field - one for the name, the other for the status. ISTR we discussed that before, and rejected it, though.
Actually, as bz pointed out, theres no easy way to find all outstanding requests - you have to use each name individually. OK, you can use anyexact now that it appears in the UI (in cvs only, not yet on bmo), but still. why don't we spearate status from type? The only thing I can think of is that searching for 'review+' AND 'super-review?' becomes impossible, because theres no way to tie the status to a flag, not an attachment (or even bug). Hmm....
I think your first solution is the better one. We should check the last character of the string, and if it's +, -, or ? we do search for that in the statuses and a search for the rest of the string in the flags.
OK, then we can add two new options, for 'flag status' and 'flag name', and use the 'flag' query as a simpler option which is internally split up into the other two. We should also error out if the status isn't +/-/? The main reason for splitting it up is for bug 179489 - since we will need separate options, it probably makes sense to define the one in terms of the other, to save code.