I imagine you already know how to just read a request parameter and return that as the view name. So, if you mean can it be done without modifying the controller methods, then yes.
Just wrap each controller in a HandlerInterceptor. The postHandle method gives you access to both the request and the ModelAndView.. you can modify the view name based on the request parameter. When you build for production, simply remove this interceptor from the config.
Code:
public void postHandle(HttpServletRequest request,
HttpServletResponse response,
Object handler,
ModelAndView modelAndView) throws Exception {
String view = request.getParameter("view");
if (view != null && modelAndView != null) {
modelAndView.setView(null);
modelAndView.setViewName(view);
}
}
As you imply, this could be pretty major security hole