1) Bob and Alice go to a coffee shop that uses WPA2, but gives the password to paying customers.
2) Alice uses the exploit to acquire Bob's PSK.
3) Alice records and decrypts all of Bob's traffic.
WPA(2) largely just made it more difficult to brute force network passwords (vs WEP) but did nothing for privacy of the users. Unless you're using certificates for authentication, everything you do is visible to anyone else who has the password.
It's a shame, because it would have been very easy to address by just using Diffie Hellman when determining the session key.
"it would have been very easy to address by just using Diffie Hellman when determining the session key"
Since WPA is implemented in hardware you must add gates to support Diffie Helman. This adds cost, resulting in a cost/security trade off.