The fact that the contents of path argument is not described other than as “derivation path” + special case for https?:// should probably be considered as documentation bug. Looks like in addition to URLs, it can take whatever is accepted by path value, including lookup paths.
Indeed:
[nix-shell] will then start an interactive shell in which all environment variables defined by the derivation path have been set to their corresponding values, and the script $stdenv/setup has been sourced.
[--attr selects] an attribute from the top-level Nix expression being evaluated.
For concrete examples:
nix-shell foo/bar would more or less evaluate the expression equivalent to possiblyFillInArgumentsIfTheResultIsAFunction (import ./foo/bar/default.nix) and use the resulting derivation environment & co.
nix-shell foo/bar --attr hello would similarly evaluate the expression corresponding to (possiblyFillInArgumentsIfTheResultIsAFunction (import ./foo/bar/default.nix)).hello.
Order of arguments of CLI programs usually does not matter unless explicitly specified.
It is probably listed in the docs last because it is orthogonal to the --packages flag which is conventionally used last just like the --attr flag: