That or share too much information about yourself or your other online activity or download malicious content. It doesn't even have to be malware as such but say an MP3 where your media player tries to download cover art, any kind of functionality that could lead to non-TOR traffic. Or socially engineer you to visit a popular YouTube video in your ordinary browser using a special URL. It could be they have a exploit on core TOR, but in that case I'm guessing it's in the NSA vaults along with the AES backdoor.
People don't understand the power of profiling and combinatorics. For example say you look at my posting history, I've probably casually mentioned my age a few times - let's say you have my birthday pinned down to a month even though I never said when it was. My sex too in some context, I presume. And I've at one point mentioned my country, my hometown (>150k) and that I used to live in the capital (>600k). If you have a post saying "I'm moving back home soon" that's enough to pinpoint me, if you have access to the right registry.
How does that work? Well you have ~145k registered domestic moves. Only ~49k are between different parts of the country. In total there's about ~9k for my hometown, those are all public statistics. So about (49/145)*9k = 3k long-distance moves to my town, for argument we'll assume all are from the capital. If average lifespan is 80, my month is roughly 1/(80*12) of the total population so ~3 moves of people my age and ~1.5 if you add sex. If soon means the coming month you're down to 1.5/12 = ~1/8. Even with some non-uniformity and whatnot it'll probably be one, at most two.
People don't stop to think about these things, particularly when it appears to happen in "private", but services get compromised. Or are honeypots to begin with. And even if you use PGP or some other secure channel, what used to be a buddy today can be compromised tomorrow. And this gets more and more important as we leave more and more "real world" electronic traces, like that concert you were at - were you also tagged on Facebook? In the past it would have been almost useless information, today a few such tidbits of information can easily lead to just having a handful of suspects to investigate closer.