[kh99]

I'm not an expert on the subject, but I think the risks range from mostly harmless "broken" html that might make the page look wrong, to running scripts or other things that could be harmful or trick users into doing something (because users will trust it like it's your site).

As for why it's an option, I guess there might be situations where the forum owner decides to take the risk, like maybe a company internal forum where all the members are employees (or maybe if you trust everyone who has permission to post, like all admins). It's a simple option to implement, because in the end the post has to be html, so really it's just turning off the processing that would otherwise need to be done.