This parameter is a JSON string and is usually specified when the application needs to pass some data to itself. The example of the usage:
http://www.facebook.com/somedummypage?sk=app_xxsome appcodexx&app_data=somedataIf this parameter is specified in url of the page tab on the server side of the application it will be available as a part of signed_request ($_REQUEST['signed_request']). So, in the example above this parameter will be available as $_REQUEST['signed_request']['app_data'].