51% is not needed to do a double-spend. All you have to do is send one transaction, then send another transaction to a different address using the same inputs (the standard client does not allow you to do this, but it is possible with a modified client). Only one of the two transactions can possibly be accepted as valid, and once one of those transactions is confirmed, the other one is invalid and will never be confirmed, and anyone who was counting on that transaction being valid is out of luck. This is why you should always wait for transactions to be confirmed before assuming the money is yours. A 51% attack is only required to take back transactions which have actually been confirmed.

Satoshi Dice uses a neat trick to avoid the problem of double-spending: it sends back the coins you originally sent as part of the payout. Since it is not possible to invalidate only part of a transaction, if your original bet is later invalidated due to it being a double-spend, your whole payout is also invalidated.