Is blablacar safe for refugees crossing borders in Europe?

The comments about entry into Germany/using BlaBla car without a Visa or proper ID being illegal are rather missing the point of applying for asylum - entry via normal avenues is often impossible for asylum seekers (e.g. you can't use "seeking asylum" as a justification for a visa application to the UK), but they are protected from prosecution under certain conditions for illegal entry by the 1951 Refugee Convention, which all EU states are signatories to:

Article 31

refugees unlawfully in the country of refuge

1. The Contracting States shall not impose penalties, on account of their illegal entry or presence, on refugees who, coming directly from a territory where their life or freedom was threatened in the sense of article 1, enter or are present in their territory without authorization, provided they present themselves without delay to the authorities and show good cause for their illegal entry or presence.
2. The Contracting States shall not apply to the movements of such refu- gees restrictions other than those which are necessary and such restrictions shall only be applied until their status in the country is regularized or they obtain admission into another country. The Contracting States shall allow such refugees a reasonable period and all the necessary facilities to obtain admission into another country.

Whether or not moving from Croatia to Germany would actually allow them to successfully claim asylum in Germany is another matter.

Two key requirements on the refugee are that they "present themselves without delay" to the authorities (easy enough) and that they are "coming directly" from where they were threatened. The exact meaning of the second is somewhat disputed but see section 3 here for the UNHCR's view. In the case of Germany, extensive information is available here, they even have a section on transfers to Croatia:

Suspension of transfers and individualised guarantees for specific Member States

Croatia: Several administrative courts have halted Dublin transfers > to Croatia, referring to illegal push-backs of asylum seekers to Bosnia Herzegovina and Serbia and police violence against asylum seekers, while other courts see no danger of push backs for returnees from Germany (for an overview see tables above and below). With a total of 95 transfers compared to 4,657 outgoing requests and 3,276 cases accepted by Croatia, the ratio of transfers to requests was much lower than the average of all member states.

ID is not required for Blablacar, but your friend will have an easier time finding rides if they verify their profile by adding photo ID. The platform itself does not try to check visas etc, although there's always a risk that you get stopped by police for some reason. (Of course, this applies to trains and buses too.)

It's safer than hitchhiking, since at least there's a record of who you're driving with, but also more expensive, since you're expected to pay.

Does he need to show the driver his passport

Blabla car offers to verify IDs and encourages drivers to only accept international passengers with a a verified ID. It's unlikely that your friend would find a ride without ID

and is this a relatively safe

Depends on what you mean "safe". While there are no mandatory border controls, they sure can be controls and than both your friend AND the driver can be in a world of pain.

Here is a cautionary tale https://www.euronews.com/2018/09/04/italian-jailed-and-fined-after-unwittingly-driving-migrants-across-border-with-blablacar . That's why any driver would be really stupid to accept an international passenger without a verified ID.

Look, I feel for your friend, but they are trying to do something that most likely is illegal and that's never a good idea. For better or for worse, they need to follow the asylum rules that currently apply to them at their current location. They could try to present themselves to the German embassy in Zagreb (Ulica grada Vukovara 64, 10000 Zagreb) but whether this has any chances of success depends on your friend's details and it's not risk-free either.

My friend without visa or any documents wants to use blablacar to get from Zagreb to claim asylum in Germany

They have to claim asylum in Croatia

This is due to the Safe third-country principle :

The safe third country concept is applied in the context of international protection of refugees and asylum-seekers. It refers to any country that provides protection to those seeking safety in accordance with the Geneva Convention, applies the principles of international law with regards to refugees, and guarantees the prohibition of removal to the territory of a country where s/he would be exposed to the death penalty, torture, inhuman treatment, or punishment. Thus, a person arriving from a safe third country who seeks asylum in a state applying this concept (e.g., a person from Norway seeking asylum in Sweden) might find his/her application for international protection rejected as inadmissible.

It is important to mention that the safe third country concept can serve as the grounds for inadmissibility even if the applicant only stayed or traveled there for a short period but sufficient time to have the opportunity to request effective protection.

Which is implemented in German law

(1) Any foreigner who has entered the federal territory from a third country within the meaning of Article 16a (2), first sentence of the Basic Law (safe third country) cannot invoke Article 16a (1) of the Basic Law. He shall not be granted asylum. The first sentence above shall not apply if

1. the foreigner held a residence title for the Federal Republic of Germany at the time he entered the safe third country,

2. the Federal Republic of Germany is responsible for processing an asylum application based on European Community law or an international treaty with the safe third country, or if

3. the foreigner has not been refused entry or removed on account of an order pursuant to Section 18 (4) no. 2.

(2) In addition to the Member States of the European Union, safe third countries are those listed in Annex I.

(3) The Federal Government shall resolve by statutory instrument without the consent of the Bundesrat that a country listed in Annex I is no longer deemed a safe third country if changes in its legal or political situation give reason to believe that the requirements mentioned in Article 16a (2), first sentence of the Basic Law have ceased to exist. The instrument shall expire no later than six months after it entered into force.

Croatia is an EU Member, as are Slovenia and Austria