The most plausible hypothesis I've heard so far (mixed with my own speculation) is that whatever code handles notifications runs into some sort of resource exhaustion (whether it's a memory overflow or an integer overflow or somesuch), causing Springboard to segfault. Cydia's substrate catches this on jailbroken devices, causing Springboard to enter Safe Mode (which is unaffected by this bug), while non-jailbroken devices - unable to handle Springboard crashing - resort to rebooting.