Found a nice write up here. Just thought it's worth sharing as most people are unaware of this. There is one more nasty reason for df and du to show different output which is not discussed there. May not be worth discussing there.
Me had a case where an administrator installed a system with just 5GB allocated to /. Later he figured out the log files in /var is quickly growing up and / will fill up very soon. So far /var has logs of size 2GB. He just created another 10GB partition, copied the current contents of /var to it, then mounted the new partition on /var without deleting the current contents in /var.
This administrator did never document this event and quit the company. A new guy stepped in. Later, when he scanned the / filesystem (may be when the / was 100% next time) he found df and du output of / is different. (showing 2GB difference). You can imagine what is the cause?
The worst question is how a Technical Support Engineer figure this out? Wild guesses? But I had to.