In short, it allows scammers to display a fake URL bar and hide the real one. Users accessing websites from their computers are not in jeopardy, since all popular web browsers do not allow websites to modify in any way the text in the address bar or to hide the address bar itself.
There are two mitigating circumstances that allow alert users to spot the trick:
- While the page loads, the real address bar is visible
- When the page is rendered, the real address bar is visible if the user scrolls up.
He says that he notified Apple about the issue, but that they could not say when it will be addressed.