It's pretty simple. The specification allows the access point to send a special packet, a "deauth" packet, to any particular client. The "deauth" packet tells the client, "please disconnect from me, then re-connect and re-authenticate". A perfectly reasonable set of functionality for the protocol to support.
The problem is that "deauth" packets are not authenticated or protected by crypto, even if you've enabled crypto on your wireless network. Therefore, a malicious attacker can send a spoofed "deauth" packet that pretends to have come from the access point to any individual client. That client will think the "deauth" packet came from the access point, and try to reauthenticate.
Why does this matter? Well, for most purposes it doesn't matter. But in some cases there are attacks that the attacker can do only if the attacker can eavesdrop or tamper with the initial handshake. What's an attacker to do if he shows up after the client has already performed the initial handshake? Why, he can simply send the client a spoofed "deauth" packet and force the client into re-authenticating and doing the initial handshake over again -- and now the attacker can do whatever he wanted to do during the initial handshake. So the "deauth" packets give the attacker a little bit of extra control, which helps in some attack scenarios.