I wasn't sure this would work. One quick unit test verifies that it does. Very good to know:
Query query = getEntityManager().createQuery("from User order by ?");
I don't know why it wouldn't work, really, but I had only used replaceable parameters in the WHERE clause of queries before.