If it were me doing it, I wouldn't bother with cron.  Cron only wakes up once every minute.

Instead, I'd create a custom bitcoin daemon that acts as a node receiving and forwarding all bitcoin transactions as they are relayed throughout the network.  Any time it receives a transaction to an address that it's designed to auto-forward, it would create the forwarding transaction and relay it immediately after it relays the received transaction.  The delay between the sending of the initial transaction and the stealing of the funds would be limited only by the time it takes for the first transaction to be relayed to my node, and the time it takes to build and sign a rawtransaction.