If you overflow the stack it throws and rolls back (which is another attack in certain circumstances). What killed TheDAO is basically that childDao called back the sender method, which sends again without having deducted yet.
Do the deduct before the send, and the whole problem goes away.
Do the deduct before the send, and the whole problem goes away.