You want to put multiple names in your certificate if you want to use the same certificate for several sites. Typically, these sites are all on the same physical server, and you just want one certificate to manage.
As an example, Google's own certificate on their "country" sites (e.g. www.google.ca
for the Canadian version of Google) currently contains all these names in its SAN extension:
DNS Name: *.google.com
DNS Name: *.android.com
DNS Name: *.appengine.google.com
DNS Name: *.cloud.google.com
DNS Name: *.google-analytics.com
DNS Name: *.google.ca
DNS Name: *.google.cl
DNS Name: *.google.co.in
DNS Name: *.google.co.jp
DNS Name: *.google.co.uk
DNS Name: *.google.com.ar
DNS Name: *.google.com.au
DNS Name: *.google.com.br
DNS Name: *.google.com.co
DNS Name: *.google.com.mx
DNS Name: *.google.com.tr
DNS Name: *.google.com.vn
DNS Name: *.google.de
DNS Name: *.google.es
DNS Name: *.google.fr
DNS Name: *.google.hu
DNS Name: *.google.it
DNS Name: *.google.nl
DNS Name: *.google.pl
DNS Name: *.google.pt
DNS Name: *.googleadapis.com
DNS Name: *.googleapis.cn
DNS Name: *.googlecommerce.com
DNS Name: *.googlevideo.com
DNS Name: *.gstatic.cn
DNS Name: *.gstatic.com
DNS Name: *.gvt1.com
DNS Name: *.gvt2.com
DNS Name: *.metric.gstatic.com
DNS Name: *.urchin.com
DNS Name: *.url.google.com
DNS Name: *.youtube-nocookie.com
DNS Name: *.youtube.com
DNS Name: *.youtubeeducation.com
DNS Name: *.ytimg.com
DNS Name: android.com
DNS Name: g.co
DNS Name: goo.gl
DNS Name: google-analytics.com
DNS Name: google.com
DNS Name: googlecommerce.com
DNS Name: urchin.com
DNS Name: youtu.be
DNS Name: youtube.com
DNS Name: youtubeeducation.com
There is no reason for names in a SAN extension to lead to Man-in-the-Middle attacks. Remember that the SAN extension is part of the certificate, and the certificate is cryptographically signed, which means that nothing can be added to, removed from or altered within a certificate without breaking the signature.
It is of course up to the Certification Authority to verify that the requester really owns all the relevant domain names before issuing (i.e. signing) the certificate with the SAN extension.