Imagine this L3VPN topology with BGP running between PE-CE links.
CE1 ------ PE1 ------ P ------- PE2 ------ CE2
CE2 advertises his loopback as a BGP route PE2. Based on that route, PE2 learns CE2's MAC address.
PE2 advertises prefix CE2 as a VPN route to PE1, PE1 advertises it as an IP route to CE1.
Now CE1 can ping CE2. When the packet reaches PE2 with a VPN label, PE2 pops the label and sends the packet out to CE2 – with CE2's MAC address, which it learnt when it received the above-mentioned BGP route from CE2. No vrf-table-label needed here.
Now Imagine this L3VPN topology where CE1-PE1 is running BGP but there is no protocol running in PE2's routing instance, since it's connected to a switch behind which are several simple servers. The servers and PE2's VRF interface are all on the same subnet.
CE1 ------ PE1 ------ P ------- PE2 --- SWITCH --- servers
Since PE2 has not received any messages from the servers, he doesn't know any of their MAC addresses. But say he advertises his VRF interface's DIRECT route (equal to the subnet containing the VRF interface address as well as all the server addresses) as a VPN route to PE1, PE1 advertises it to CE1. Now CE1 has a route to reach any of the servers. When CE1 sends a packet to one of the servers, PE2 receives that packet with the expected VPN label. Normally he would remove the MPLS header and send the packet out its VRF interface without any IP lookup, but now what is he going to use as the destination MAC address? He never learnt the destination server's MAC address since he never received any message from it. So he has to drop the packet. To avoid this packet drop we can have PE2 configured with vrf-table-label, in which case the IP packet is sent to the VRF table for a second lookup on the destination IP address, which will then trigger an ARP request for that destination IP address, by which PE2 will learn the destination server's MAC address, which he can then use as the destination MAC address of the packet as it sends it out its VRF interface.
The additional IP lookup also allows you to implement egress IP tools such as firewall filters on the VRF interface.
--Deepak