The two main issues that come to mind would be installation of malware via browser vulnerabilities and exploitation of vulnerabilities in other websites.
Exploiting client-side vulnerabilities in other websites
Examples: CSRF, XSSI, XSS, JSONP, CORS, postmessage, clickjacking, etc.
As you mentioned, tabs are sandboxed fairly well because of the same origin policy. But web applications can introduce vulnerabilities to weaken this separation, allowing one website to send or receive data from another one, in the name of the user.
private/incognito mode will prevent these issues to a high degree, as they rely on exploiting the current authentication a user has with other websites.
Exploiting vulnerabilities in the browser
Examples: drive-by-downloads, buffer overflows, etc
A malicious website may attempt to exploit vulnerabilities in the browser itself, which may allow execution of code on the victims computer and thus installation of malware.
private/incognito mode will not prevent this.
- Phishing. Don't enter sensitive data on sketchy sites, or sites they link to (or verify that you are actually on the site you want to be).
- Leak of information about you (IP, browser & OS info, etc).
- Leak of information about your network: the attacker can issue requests to the internal network you are in - eg by requesting images - and thus gather information about it.
private/incognito mode will not prevent these.