Sometimes you forget about the certificates you have (such as in this case). In a 'default-deny' security mindset, things you forget should expire so that you don't get bitten by a security compromise for a certificate that you issued in 1999 but still are "trusting".

Furthermore, private keys can be cracked, given enough time. Expiry dates reduce this risk with (a) less time to do it; (b) key is invalidated even if you don't know that it's been compromised, so every compromise ends sooner or later, and (c) renewed certificates can be made with longer keys as hardware gets more powerful.

Take a look at me.com, for example. Before Apple bought it, it was owned by SnappVille.com. If SSL certificates didn't expire, SnappVille could have continued using their certificates for me.com.