I would think that common sense would dictate that a merchant using an automated system would not consider a transaction 'paid' until at least one confirmation ?

Is there really a big risk in seeing the transaction with 0 confirms and acting on it ?  I've read the high level info on unconfirmed, confirmed transactions, but I don't think I fully understand the risk.  Could someone provide a real example of a transaction 'showing up', but never getting a confirmation ?

I guess what I'm asking is the apparent trade-off:

0 confirms == very fast/ near instant processing
>0 confirms == variable time until 'paid' status, but safer ?