It is simply someone who sends a transaction with RBF enabled as payment for a product or service but receives such product or service before the transaction is confirmed and what they do is send that amount of Bitcoin to another address with a higher fee.
With full RBF becoming more commonplace, this attack is becoming possible with any transaction, whether or not it is opted in to RBF.
You might also be interested to read this post, which describes how a miner can double spend a transaction with one confirmation:
https://bitcointalk.org/index.php?topic=36788.msg463391#msg463391. It is essentially the same scenario described by ranochigo above where there are two competing blocks at the same height, with some of the network working on one and some of the network working on the other, but the scenario has been deliberately engineered in order to give the attack the highest chance of success.