Grant Execute on SYS.DBMS_SYS_SQL, Smart DBAs say NO
The Oracle database ships with a supplied but undocumented PL/SQL package named SYS.DBMS_SYS_SQL. This package enables the execution of dynamic SQL but it also enables the parsing of a statement as a specific database user and with the privileges of this specific database user. This PL/SQL package is highly privileged, obviously. The EXECUTE privilege on this package is not granted to database user, by default. It should almost never be granted to any database user, ever. When asked to grant execution on this package to someone, a smart DBA will always say "no."
via http://joelkallman.blogspot.com/2010/08/application-express-and-parsing-of-sql.html
More from http://www.pythian.com/news/652/using-dbms_sys_sql-to-execute-statements-as-another-user/