EDIT Dec 2019: `call.value()()` should now be used for transferring ether.

See:
https://ethereum.stackexchange.com/questions/78124/is-transfer-still-safe-after-the-istanbul-update-2300-gas-limitation


----------
The following is the original answer.

`contract.call.gas(...).value(...)(...)` is a [way to add Ether and limit gas](http://solidity.readthedocs.io/en/latest/frequently-asked-questions.html#what-does-p-recipient-call-value-p-amount-p-data-do) when invoking a contract.  Basically, TheDAO used `call.value` to move Ether around in a generic way.

`contract.call.value(...)()` will [invoke](https://ethereum.stackexchange.com/questions/1585/why-does-an-empty-message-still-invoke-the-code-of-the-contrac) the [fallback function](https://ethereum.stackexchange.com/questions/5992/how-much-computation-can-be-done-in-a-fallback-function) at `contract` with almost all the gas that the caller has.  In a normal call like `contract.foo`, if `contract` is untrusted, it is much clearer that untrusted code (`foo`) is explicitly being invoked.

Another important difference is that any exceptions in `contract.foo` will bubble up: if `foo` runs Out of Gas, that exception immediately halts the transaction and reverts all state changes.  With `contract.call.value(...)()`, only a true or false is returned (the exception does not bubble up) and so you generally see code like `if (!contract.call.value(...)()) throw;`

Here's a glimpse into how the [reentrant attack](https://ethereum.stackexchange.com/a/6344/42) was performed:
https://ethereum.stackexchange.com/questions/6210/how-was-the-recursion-created-that-lead-to-thedao-hack.