I'm surprised that, even with 1 block confirmations, stealing bitcoins in the way that Tom describes would be feasible without a considerable amount of compromised computing power. If my understanding is correct, for an attack to succeed an attacker would have to compute 2 blocks containing their false transactions before the rest of the network computes one. This computation could be done offline so the attacker could wait until they have been lucky and computed these blocks before publishing them, but it would still require a non-insubstantial amount of compute or waiting a long time before being able to make the attack.
I'm not saying that pools are involved in this, but if even a small pool was involved, then this attack would be a lot more believable.
Will
I'm pretty sure it would work something like this.
1.) Peer directly to the bitcoind running on MyBitcoin.
2.) Solve the next block with your dubious transactions.
3.) Wait for someone else to solve the block you solved.
4.) After the same block was found, but before MyBitcoin's bitcoind hears it, announce your dubious block to MyBitcoin.
5.) That is 1 confirm, funds will now show up. Transfer the funds out, the next block on the network will orphan your dubious one.
