I have just installed Debian Woody with a base install.

My sources.list looks like this:
deb http://ftp.uk.debian.org/debian/ stable main non-free contrib
deb-src http://ftp.uk.debian.org/debian/ stable main non-free contrib
deb http://non-us.debian.org/debian-non-US stable/non-US main contrib non-free
deb-src http://non-us.debian.org/debian-non-US stable/non-US main contrib non-free

deb http://security.debian.org/ stable/updates main contrib non-free

I wish to upgrade to Debian SID. I take it that all I need to do is replace "stable" with "unstable". Correct me if I'm wrong.

Do I comment out the security line, as SID contains the most up to date packages anyway?

Also is it really safe to simply dist-upgrade to SID, or are there any pitfalls I should watch out for?

Yep, all you should have to do is replace "stable" in the first four sources with unstable followed by an apt-get update && apt-get autoclean && apt-get dist-upgrade

Regarding the security source, I've left it in mine primarily because it was set up that way by default and also because I assume any breaking security updates are released into there first so having it in there is generally a good thing.

There are no separate security updates for sid (they are just released as the next version of the package), so keeping it in there would do you no good. In fact, it'd just take longer to update.

Thanks, guys. Based on that advice I've commented out the security server line and changed "stable" to "unstable".

I have to say I cannot believe how straightforward my brief time using Debian has been.

Saying that, I'll be recompiling the kernel and installing GNOME next week so I may be eating my words...