What does Sherlock say just before opening Irene Adler's safe?

Vatican cameos!

It's pretty hard to find a definitive answer, but it looks like it is code for "Duck!".

And it's aimed only at Watson as he's the only one to react at the phrase.

Conan Doyle makes a reference about in "The Hound of the Baskervilles". (source)

I was exceedingly preoccupied by that little affair of the Vatican cameos, and in my anxiety to oblige the Pope I lost touch with several interesting English cases.

But Conan Doyle never wrote a story about it.

Just before he opens the safe, Sherlock looks at Irene (probably because he suspects there might be some kind of booby trap). She looks sharply down and to the right. It's obvious given what happens next that this look is code for "Duck!"

So he knows to duck, and she knows to duck, but someone has to warn John somehow. You can see from John's reaction and expression immediately after Sherlock yells, "Vatican cameos!" that he's reacting specifically to that phrase, not because he had any previous intent to duck.

Googling reveals that there seems to be some sort of myth going round that this is a phrase used by military personnel to indicate that there was an armed (non-military) person who had entered the base. I say myth because, despite it being repeated an awful lot on Tumblr, Yahoo! Answers and Urban Dictionary, I've yet to find a single corroborating source for it. It's also nicely debunked here.

The single place we do know of the phrase being used (prior to Sherlock) is in the original Sherlock Holmes stories.

“I was exceedingly preoccupied by that little affair of the Vatican cameos, and in my anxiety to oblige the Pope I lost touch with several interesting English cases. —Sherlock Holmes, The Hound of the Baskervilles

So, it's a nice little nod to the original stories, as we know the writers of Sherlock are keen on doing.

But what does it mean in-universe?

This is definitely a codeword very precisely targetted at John. Most likely, it's a reference to a case that Sherlock and John worked on together. The fact that it isn't explained in any more detail than "saying 'Vatican cameos' makes John duck" isn't particularly unusual for the series.

For example:

• Sherlock attacking a corpse with a riding crop in the very first episode.
• Sherlock harpooning a pig and arriving home (via the Tube!) drenched in blood at the start of The Hounds of Baskerville.

And even an example of a past case being a codeword:

• In the unaired pilot, Sherlock says, "Angelo, headless nun" to refer to a past case. Angelo simply asks, "Same again?" and when Sherlock confirms, Angelo throws him out of the restaurant as if he were drunk.

Finally, this is brought up again in The Sign of Three, with slightly more explanation as to its meaning (if not its origin).

Sherlock: Vatican Cameos.
Mary: What did he say? What's that mean?
John: Battle stations. Someone's gonna die.

It's not clear whether it literally means "battle stations" or whether that's John's translation for this context (much as his translation for the previous context was "the safe is trapped, get down"). However, it's slightly more information than in Scandal.

Vatican Cameos is a codeword used between Sherlock Holmes and Dr. John Watson. It originated in WW2 when a non-military figure would enter a military-base armed. Vatican Cameos would be shouted and everyone would duck.

Having been in the military, Dr. Watson understands Sherlock's meaning and does indeed duck.