Probably the most dangerous thing about public WiFi is that someone can set up a fake access point with the same SSID as the real one and you won't know that you have connected to it.
Even if your browser is connecting to web sites using TLS, they can use DNS spoofing to get you to log into fake web sites and reveal your passwords for other services. This is the best reason I know to use a VPN.