The default callback URL is related to the OAuth 1.0a protocol that Tumblr uses to authenticate your app.
As the OAuth 1.0a specification explains:
OAuth Authentication is done in three steps:
1. The Consumer obtains an unauthorized Request Token.
2. The User authorizes the Request Token.
3. The Consumer exchanges the Request Token for an Access Token.
So with Tumblr process basically looks like this:
A Tumblr user comes to your website, where you have an app that requires some of the private information from their Tumblr account.
Your app will ask Tumblr for an "unauthorized request token".
After your app receives this unauthorized request token from Tumblr, it will then redirect the user to a Tumblr login page, passing the request token along with them.
The user will then be asked by Tumblr if they want to allow your app to access their account. Once the user accepts, Tumblr will authorize the request token, and then redirect the user to the "Default Callback URL" (which your question refers to).
Your app will then exchange this authorized request token for an "access token", which will enable the app to access the user's protected Tumblr data.
... Well, hopefully that clears things up a bit!