Imagine you are running a network service (e.g. HTTP) on your local machine. This is bound to both the loopback interface (127.0.0.1) and an internet facing interface (126.96.36.199).
Now say you have a script on your machine that an attacker knows can be used to perform administrative tasks, but only if performed by an administrator.
The presumption is that your script only assumes the visitor is an administrator if they are connected from the server itself. An administrative function can be called using GET variables, like: http://127.0.0.1/?droptable=foo&setpwd=bar.
If a user tried to do this from the internet, the script could see that the connecting user was on a foreign IP and it would return with, say, HTTP 403.
Now you are browsing the internet on your server (silly you). You click on an attackers link whose domain name has been associated with something dodgy, and so it's in your hosts file. Now instead of this link taking you to http://blockeddomain.com/?droptable=foo&setpwd=bar, your own hosts file ensures that http://127.0.0.1/?droptable=foo&setpwd=bar gets loaded instead.
Your database tables are dropped and the attacker compromises your authentication mechanisms.
Of course this is a very basic example and it requires many assumptions to be made. However this is one real world possibility of how such a setup could cause you a headache.