Does a secret-dependent order of access of a lookup table create a possibility for a timing attack?
At least it creates a the possibility of a secret-dependent timing variation (this may allow attack, or not, depending on context). Avoiding secret-dependent timing in a portable way requires that memory access patterns (including array indexes) are not secret-dependent.
On many architectures, timing will broadly tend to be minimal when the array is accessed in increasing or decreasing index order, which will maximize cache hits; and larger when the array is accessed in some haphazard order, tending to cause cache misses. The actual timing will depend on the state of the memory subsystem including cache, which on multithread CPUs (including most modern desktop and mobile CPUs) often depends on what other processes do. Having a cyclic access pattern will somewhat mitigate this effect, but how much remains dependent on the target CPU's architecture and activity of other processes.
Application is constant-time implementation of bit shift on multi-limb integers
Except in RC5 and RC6, I have never seldom met the need for implementation of bit shift with time independent of the shift count (this does not happen in RSA, Schnorr signature, DSA, ECDSA, EdDSA for large integers shifted by a variable shift count, except for shift count restricted to less than the limb width).
However it can be done, with much less performance hit than the obvious (multiplication by a power of two obtained in constant time). Assuming only byte access to memory, there's an easy algorithm with constant memory access pattern that shifts by $0$ or $2^k$ bits, and that can be used for each bit of the shift count. Assuming byte access to memory, we only need to special-case $k\in\{0,1,2\}$. Assuming a 64-bit barrel shifter, we can do the lower 6 bit in one pass.
