I think this txid mutability doesn't cause double-spend by itself. But if the sender (i.e. Mt. Gox) thinks (erroneously) the coins didn't arrive because they didn't see the txid and somebody complained and they did the spend again, then it depends. If the sending address still holds enough coin, or if they use a different address then the sender does a double-spend. It could be that somebody acquired knowledge of their accounting flaw and used it to their advantage.
+1.
If this truly happened (a lot of times) than Mt.Gox is in trouble as they double-spent the money themselves without double-checking what really happened.
However, it is funny how they managed to move the discussion in to a different direction (bug in bitcoin) instead of explaining why they stopped the withdrawals. Ok, they were using txid and their systems where not able to pick up the transactions after they sent it automatically, however why do they stop all withdraws and request a change in code of BTC and do not simply change their own code (or give a timeline how long it takes to change their code)?