Basically what UPnP in the router does is accept messages from LAN devices that can modify the Network Address Translation for Port forwarding.
The LAN device has to support this. While XBOX Live can be done without it, it is far easier to do it with UPnP on.
Why turn it off at all then if it makes your life easier?
Simply security. It is possible that a computer browsing to a website can set up a UPnP port forward back into that computer without you knowing it.
What is the actual risk? Depends on how much caution you use going to websites you are not familiar with. Sites like Facebook are not a risk, but Facebook Apps and Games increase the risk, for example.
It is important to note that your computer or device must initiate the connection to the outside world and often times actually connect to the remote site before the UPnP Port forward will actually be put in place. These port forwards are stored in temp memory and when the router is power cycled, it starts all over again with a blank UPnP table.