I would say to anyone, if you are not using your wireless connection - Disable it. (Forget security for a second - you can save battery life!)
I have not personally seen any attacks on one that is not connected to a network, but that doesn't mean it is not possible...
I think that it is very far fetched, but, if you are using a driver where a vulnerability exists, it could be possible to remotely cause it damage without connecting - for example, a special character/command in a SSID, or possibly some sort of command targeting the device by MAC address (not 100% sure on this point as it is not actually connected).
If the above is true and there is a vulnerability at driver level, it would most likely be irrelevant whether you use Windows, Mac, Linux or other - arbitrary code could be executed, it would just need to be recompiled/changed slightly for the target.
These are all possibilities however, I doubt they exist/anyone is actively using them. Also worth mentioning (If you are a foil hat type person!) it is possible that a driver making company actually put remote execution code inside a driver for this sort of thing... Again, possible, but unlikely.
What is much more likely is you get people starting fake access points with the same SSID as public hotspots (e.g. BT Openzone, Cloud, T-Mobile etc.) and hope that your device has remembered the setting then automatically connects.
As for security concerns on the above, it would be the same as anything on a home network - any unpatched security hole could be used as an attack vector - with the addition that anything you do on these could be logged, redirected or other.
It is important in Vista/7 to choose
Public as the location so it locks down the connection as much as possible including some of the main Windows attack vectors (e.g. stops SMB file sharing), I am not sure/cannot comment on similar location based security on MAC or Linux.