For me, the two classic use cases are:

1. Things that work more-or-less like the ANSI-defined specials
   such as *READ-BASE*, that is, large numbers of miscellaneous
   global parameters that you *usually* want to just leave alone
   but sometimes want to rebind for the dynamic extent of one
   subtree of function calls.

   Thanks *goodness* for specials for this case!! Passing the ~20 (!)
   or so specials that affect the Lisp printer [see CLHS 22.1.1.1]
   around in every function call just to enforce some kind of
   functional "purity" would simply be insane.

2. Things that hold "this request" (or things *about* "this request")
   for request/response protocols, especially when using some kind
   of threading so that there are multiple "this" objects live at
   any one instant. E.g., my personal web infrastructure has a special
   named *HTTP-REQUEST*, a structure of type HTTP-REQUEST (duh!) that
   holds all the gunk related to one -- freshly bound by the thread
   that gets spawned upon each new ACCEPT on port 80. As the request
   goes through the steps of its processing, various additional bits
   of gunk get added to (or deleted from) the HTTP-REQUEST object.
   After responding, the thread dies, and on its way out *HTTP-REQUEST*
   gets unbound and the object gets GC'd, eventually. [No, I don't try
   to re-use them, though I do (sometimes) re-cycle the connections
   they had open to PostgreSQL.]

   Another similar, though non-threaded, case is a discrete
   event simulator, where specials with names like *CURRENT-TIME*,
   *CURRENT-PROCESS*, *CURRENT-EVENT*, *CURRENT-NET*, *CURRENT-
   DRIVER*, etc., may get bound & re-bound by the simulator's
   main event loop [possibly a *very* large number of times
   for one tick of *CURRENT-TIME*!], so that any given instance
   of an object being simulated has a lexically-constant but
   dynamically-varying environment. [Yes, Kenny, such things
   should probably all be re-written in Cells. Humor me.]

-Rob