Is it bad practice? any SEO, usability or word-of-mouth penalty?
http://www.barnesandnoble.com/ is doing fine with it...
I personally would not use "and" in domain names. To me it is unusual, and there is no clear convention on how it's used, so I would worry that customers mistype it. To re-use the existing example, I would worry that the end user could misspell it as barnes-and-noble.com, barnes&noble.com, barnes-&-noble.com etc (you can't use ampersand in conventional domain names, but again, end users might not know that).
I would most likely use a dash instead of the "and", as well as registering the domain both with and without dash. So I would have used barnes-noble.com and also have registered barnesnoble.com (and set up redirection to the domain in use).
The use dash or not discussion has already been covered on this site and elsewhere. :-)
I used to work for a firm with "&" in the name but their domain included the full word "and". It was highly confusing and (pun fully intended) I bet they lost half of the people who googled to try to find them.
I will not recommend using "and" in domain name. It can be confusing. There are some rare exceptions perhaps. My focus is mainly in the area of 2 word domain names, 1 word are not available or too expensive for me and 3 words are too long.
Try also to split by hand the domain names on all the possible combinations. This will give you an idea of how confusing is you domain name for people that see it for the first time. Some domain names are to ambiguous.
On my site, HotNamelist.com, I help people find domains. I've found that fewer than 0.5% domains regisitered thru my site include the word "AND". Mostly this is because you have at least a 3-word domain when using "AND", so those are already less popular.
Given that, some of the ones that are registered are not so bad. Here's a list of the ones that people have taken... good examples of decent 3-word domains: