At the moment the coordinator protects the network from 34% attacks. What exactly can and can't such an attacker do when the coordinator is shut down?
Just like in Bitcoin or any other cryptocurrency, such an attack would aim for a doublespend. A doublespend is a successful attempt in confirming a transaction that uses the same balance that was addressed to a receiver but will be also sent to a second receiver to scam the former (original) one. To attack the tangle efficiently, an attack would need to get a broad overview - or omnipresence - of parts of the network. There are a couple of comments worth reading from the founders of IOTA in which they explain the difficulty for such an attempt in the Tangle. And while IOTA is in its childhood days, there is the coordinator - functioning as training wheels - protecting the network against such attacks.