global $user can be overwritten and switch accounts

Hello,

I didn't noticed this issue in the bug reports so I thought I would report it.
Tonight I was calling: global $user inside of my hook_preprocess_page. In my logic I had something like this:

global $user;
...
$user = user_load(arg(1));

I was checking something when you were on a user's profile page, but what happened was the global variable had been overwritten, this caused me to literally be logged in as the user who's profile I was looking at. I was testing this with a plain authenticated user's role, when I viewed user 1's account it switched the accounts. I had full access to everything.

I fixed this by doing:

global $user;
...
$_user = user_load(arg(1));

But you may want to take a look into this. From the looks of what happened it seems that your authentication system depends on that global variable, which I don't think is good practice but I may be wrong, just trying to help.

Trevor