Generating a password reset token without any expiration time opens up a potential security flaw. Not a very easily exploitable one, but an easily preventable one nonetheless. More info: http://www.owasp.org/index.php/Forgot_Password_Cheat_Sheet#Step_3.29_Send_a_Token_Over_a_Side-Channel
In addition to their email account being compromised, there's another possible scenario: if a user clicks Reset Password but never gets around to actually resetting their password, anyone who gets access to the backend database at any point in the future can reset that user's password. This would be much faster than trying to crack the encrypted password. And since by default there is no email sent upon password change, the user might not ever know that their account has been compromised.