But if a web application server has TRACE enabled, attacker can just send e.g. XMLHttprequest (AJAX) to the target server. Browser will attach the cookies to the request, the server will echo them in response - and attacker's JS code will get the response and will be able to hijack the session.
The vulnerability is called Cross Site Tracing and has been described in this white paper.
However, since 2003 when this vulnerability has been discovered, many browsers simply disallowed sending requests with TRACE method. Also the specification for XMLHttpRequest disallows TRACE method now. I don't have any concrete results on which browser allows sending TRACE right now, the closest match I found is this article.
But still, there probably are some old browsers around - and other plugins like Flash, Silverlight, Java that often receive cookies from the browser and may use them for sending TRACE. So disabling it is now the only option to be sure you're not vulnerable to Cross Site Tracing. And it's easy too - just use TraceEnable off in Apache.