I'd strongly recommend to add a directive in coding standards to ban common (global) variable names for temporary tasks.
This is a very important security issue as it can lead to certain accidental variable overwrites such as:
In context of a $node some code tries to load assigned user object and does $user = user_load($node->nid);
While this feels pretty OK for the first second one single global $user before this line will lead to a user context switch and thus permission takeover.
This is a very common mistake i've seen many times - and which happens too soon...
We should therefore ban all common variable names for temporary use and suggest using alternatives.
Sample:
BAN $user --> SUGGEST $account
All global drupal variables should be banned.

Comments
A recent issue added a note
A recent issue added a note about this to the documentation for user_load().
Happy
That's cool, i'm really happy to see that coming up.