Is there a possible/safe way to do a sub-request
I do this as following:

// We mimic menu_execute_active_handler().
$router_item = menu_get_item($href);
if ($router_item['access']) {
  if ($router_item['include_file']) {
    require_once DRUPAL_ROOT . '/' . $router_item['include_file'];
  }
  $page_callback_result = call_user_func_array($router_item['page_callback'], $router_item['page_arguments']);
}
else {
  // Access denied.
  $page_callback_result = MENU_ACCESS_DENIED;
}

if (is_array($page_callback_result)) {
  // Render array.
  $output .= drupal_render($page_callback_result);
}
elseif (is_string($page_callback_result)) {
  // Render string.
  $output .= $page_callback_result;
}