Why does the authenticated cipher CCM encrypt the MAC too? Suppose I have Encryption in CTR-Mode and a CBC-MAC. Why should I also encrypt the MAC?  

In the documentation of NIST stands: "By encrypting T we avoid CBC-MAC collision attacks".

But I can not imagine an attack based on an not-encrypted MAC.
Can anyone give me an example of such an attack?
Let $M_k$ be CBC-MAC under the key $k$: for blocks $b_1, b_2, \dots, b_\ell$, $$M_k(b_1 \mathbin\| b_2 \mathbin\| \cdots \mathbin\| b_\ell) = E_k(\cdots E_k(E_k(b_1) \oplus b_2) \cdots \oplus b_\ell).$$

The message $m = m_1 \mathbin\| m_2$ collides with the message $m' = M_k(m_1) \oplus m_2$ under $M_k$, since

\begin{align}
  M_k(m_1) &amp;= E_k(m_1), \\
  M_k(m_1 \mathbin\| m_2) &amp;= E_k(E_k(m_1) \oplus m_2), \\
  M_k(M_k(m_1) \oplus m_2)
   &amp;= M_k(E_k(m_1) \oplus m_2)
    = E_k(E_k(m_1) \oplus m_2).
\end{align}

If the CCM ciphertext for $m_1$ revealed $M_k(m_1)$, then an adversary could use that and the CCM ciphertext for $m$ to forge the CCM ciphertext for $m'$ since the CTR encryption preserves $\oplus$.  To thwart this, CCM encrypts the authentication tag too, with an additional block in the one-time pad generated by CTR.