Well, there's always INFORMATION_SCHEMA.COLUMNS to play with. If you go the dynamic SQL route, you can find all the column names for any given table, and then use the QUOTENAME function to enclose them in brackets so you don't have column name issues.
Personally, I stay away from INFORMATION_SCHEMA views. If I need metadata information I go to the sys.<system views> since they have more information should I need it.