Curious about a network-based double-spending attack
That sort of attack sounds definitely doable. But it's important to take into consideration the cost of this type of attack versus the cost of the thing that you're actually stealing (double-spending):


If you're buying something expensive, the vendor will most likely
require you to wait at least 2-3 confirmations, defeating the
possibility for this type of attack.
If you're buying something inexpensive, the vendor could probably accept unconfirmed transactions, opening the possibility for a double-spending attack. But as an attacker, it'll probably cost you more to pull off this kind of stunt than actually buying the thing.


In conclusion, this type of attack can probably be successful, but the costs outweigh the benefits.