JavaScript (Firefox 30+), 465 428 bytes
f=s=>/\{/.test(s)?f(s.replace(/([^,{}]*\{[^{}]*\})+[^,{}]*/,t=>t.match(/[^{}]/g).map(u=>u.split`,`).reduce((a,b)=>[for(c of a)for(d of b)c+d]))):s.split`,`.join` `
s=>f(`{${s.split` `}}`.replace(/\{([-\w]+)\.\.([-\w]+)(\.\.(\d+))?\}/g,(m,a,o,_,e)=>{m=(a>'@')+(a>'_');a=parseInt(a,m?36:10);o=parseInt(o,m?36:10);e=+e||1;if(o<a)e=-e;for(r=[];e<0?o<=a:a<=o;a+=e)r.push(m?a.toString(36):a);r=`{${r}}`;return m-1?r:r.toUpperCase()}))
ES6 version of f weighs in at an extra 10 bytes:
f=s=>/\{/.test(s)?f(s.replace(/([^,{}]*\{[^{}]*\})+[^,{}]*/,t=>t.match(/[^{}]/g).map(u=>u.split`,`).reduce((a,b)=>[].concat(...a.map(c=>b.map(d=>c+d)))))):s
Explanation: Starts by changing spaces into commas and wrapping the entire string in {} for consistency (thanks to @Blue for the idea). Then searches for all the {..} constructs and expands them into {,} constructs. Next uses recursion to repeatedly expands all {,} constructs from the inside out. Finally replaces all commas with spaces.
f=s=>/\{/.test(s)? while there are still {}s
f(s.replace( recursive replacement
/([^,{}]*\{[^{}]*\})+[^,{}]*/, match the deepest group of {}s
t=>t.match(/[^{}]+/g split into {} terms and/or barewords
).map(u=>u.split`,` turn each term into an array
).reduce((a,b)=> loop over all the arrays
[for(c of a)for(d of b)c+d])) cartesian product
):s.split`,`.join` ` finally replace commas with spaces
s=>f( change spaces into commas and wrap
`{${s.split` `}}`.replace( match all {..} seqences
/\{([-\w]+)\.\.([-\w]+)(\.\.(\d+))?\}/g,(m,a,o,_,e)=>{
m=(a>'@')+(a>'_'); sequence type 0=int 1=A-Z 2=a-z
a=parseInt(a,m?36:10); convert start to number
o=parseInt(o,m?36:10); convert stop to number
e=+e||1; convert step to number (default 1)
if(o<a)e=-e; check if stepping back
for(r=[];e<0?o<=a:a<=o;a+=e) loop over each value
r.push(m?a.toString(36):a); convert back to string
r=`{${r}}`; join together and wrap in {}
return m-1?r:r.toUpperCase()})) convert type 1 back to upper case