A "recursive calling vulnerability" is an **ambiguous term that should be avoided** because it is imprecise and can mean 2 things.

## Reentrant attack ##

You probably mean "reentrancy vulnerability" or "reentrant attack", which is what @Roland's answer describes.  Note: **not all reentrant attacks have to be recursive** (in the sense that malicious code does not have to reenter the same way: it can reenter a contract via **any** externally accessible function).

http://forum.ethereum.org/discussion/1317/reentrant-contracts

https://github.com/LeastAuthority/ethereum-analyses/blob/master/GasEcon.md

<s>
## Call depth attack (no longer possible with EIP 150) ##

In Ethereum, a "call depth attack" is also possible (one of the ways it can be performed is with recursive calls).

https://ethereum.stackexchange.com/questions/6150/how-does-the-stack-depth-attack-make-a-send-silently-fail

https://ethereum.stackexchange.com/questions/6260/solidity-callstack-attack

</s>