What are the safety guidelines for using the Sign Message feature? bitcoin-qt's dialog box states, "Be careful not to sign anything vague, as phishing attacks may try to trick you into signing your identity over to them. Only sign fully-detailed statements you agree to."

What would this kind of attack look like?  What are some examples of statements that would be safe to sign agreement to?
The signing mechanism is a way of proving that a particular message was signed by the holder of an address' private key.  A merchant could ask that you sign a message stating where you want your order shipped to, using one of the addresses your payment originated from.

You should sign a statement saying "I, Jane Doe (jane.doe@email.com) sent 1.23 BTC to Acme Corp at 12:34pm, 1st Jan 2012 in payment for product XYZ for delivery to 456 High Street, Anytown, USA".

You shouldn't sign a vague statement saying "yes, I sent that money; send the product to the address I emailed you", because anyone seeing a copy of that signed message can then pass that on to the merchant with his own postal address and get the product you paid for, in the same way as you wouldn't put your signature to a piece of paper saying "I agree to the above" where the above was left blank.  The postal address part won't be signed, but perhaps the merchant won't care.