Add a "user" parameter to the Context Macro to control the current user

If the author has programming right, I don't see any problems regarding security.

Same here, you can technically do something like this in a Groovy macro, for example. So I don't have anything against this feature as long as the author of the content which call this macro has programming right.