As Joie has stated and as Paul Randal's article explains even with safety on (synchronous mode), without a witness a mirror disconnection will allow the principal to stay online and the send queue to grow, this represents the data loss risk factor.

Also, in normal operation, if the principal fails before this send queue has been processed by the mirror, the mirror needs to be forced into service at the risk of data loss.