Compute hashes faster than the rest of the network and you win. The "51% attack" is a polynomial time attack, which is not an acceptable security margin in cryptography.
1) Attacker starts mining a fork offline (ie. doesn't publish blocks)
2) Attacker sends payment to merchant but does not include payment in fork in (1)
3) Attacker waits 6 confirmations then receives goods.
4) Attacker double spends the money in the fork (1).
5) Attacker releases fork when it is longer than the main chain.
If they have greater than 51% they will always be able to do (5) because at some point they'll be longer than the main chain. It doesn't matter how many confirmations the merchant waits for.