How secure is zero confirmations? I sent a small amount of BTC to someone and she was notified within seconds.  But the first confirmation did not happen for ten minutes or so.

What is the chance that this transaction could fail between the notification and the first confirmation? 

Does it all depend on how well I try to double-spend?
For small amounts, like a cup of coffee, the double-spending risk is going to be negligible. If it's a person I know, I wouldn't mind receiving and accepting as valid a transaction with zero confirmations.

For shops that will start accepting bitcoin, a stronger security measure would be for them to have multiple bitcoin clients installed in multiple geographical locations. Once each of them has "seen" the transaction they can confirm it as valid, even though it hasn't been included in the blockchain yet. 

The idea behind having several machines look and validate the transaction is that it becomes much harder for someone to propagate a double-spend against a transaction that has already been seen and propagated by several machines across the world.