The Master-Slave flip-flop construct by 2 latchs ,
The latch construct by 2 inverts connect back to back .
Draw the invert's transfer fuction Vout/Vin, the curve smoothly transit from high to low .
Now Add one another invert's transfer function , but change it from Vout/Vin to Vin/Vout . The 2 curve intercept in 3 points ,
(Vin=0 Vout=H) , (Vin=Vcc Vout=0) and 3rd point locate somewhere in the transition region of both invert's transfer function.
The 1st and 2nd points are stable , that means they can stay in these state forever . Once some noise push it offset from stable point , the direction is inward to stable point in 2 invert transfer curve . pull the offset back to its stable point . Conversly , the 3rd has the intendance to leave the intecept point and is astable . So if you have your signal setting the latch in either point 1 or 2 . It reach the stable points , but if you have your signal locate around in 3rd astable point . A small noise will change the direction from point1 to point2 or point2 to point1 . Even worse , it can jump back and forward in them . This is same situation as what make the invert to work for oscillaton .
Although it's the explanation for latch , the cause for metastable is same . You can run the spice with different conditions to confirm this .