How Do I Route Audio to Speaker without using AudioSessionSetProperty?

On each release of iOS, more of the audioSession properties are migrated to AVFoundation, so you should use those in preference whenever available.

Since iOS 6 kAudioSessionProperty_OverrideAudioRoute is represented in AVAudioSession by the method

- (BOOL)overrideOutputAudioPort:error:

Available values are AVAudioSessionPortOverrideNone and AVAudioSessionPortOverrideSpeaker

Here is an example audio session configured entirely via AVFoundation:

 - (void)configureAVAudioSession
{
   // Get your app's audioSession singleton object
    AVAudioSession *session = [AVAudioSession sharedInstance];

    // Error handling
    BOOL success;
    NSError *error;

    // set the audioSession category. 
    // Needs to be Record or PlayAndRecord to use audioRouteOverride:  

    success = [session setCategory:AVAudioSessionCategoryPlayAndRecord
                             error:&error];

   if (!success) {
       NSLog(@"AVAudioSession error setting category:%@",error);
   }

    // Set the audioSession override
    success = [session overrideOutputAudioPort:AVAudioSessionPortOverrideSpeaker
                                          error:&error];
    if (!success) {
        NSLog(@"AVAudioSession error overrideOutputAudioPort:%@",error);
    }

    // Activate the audio session
    success = [session setActive:YES error:&error];
    if (!success) {
        NSLog(@"AVAudioSession error activating: %@",error);
    }
    else {
         NSLog(@"AudioSession active");
    }

}

UPDATE

Since iOS 7.0, the Audio Session Services C API is now fully deprecated in favour of AVAudioSession.

UPDATE 2

- (BOOL)overrideOutputAudioPort:error:  

is a method, not a property, and it sets an underlying write-only UInt32 value. You can’t get the current value, and you should treat the method as setting a temporary state. If the audio route changes or is interrupted, the property resets to its default (AVAudioSessionPortOverrideNone). You can get interruption notifications via AVAudioSessionDelegate.