Can you please test again with Beta 3

It is still exactly the same error.

The calls in the stacktrace are all in the core. Could still an override from a Template trigger this? Where should I look?

Easy way to see if it is something in the template is to switch to one of the core templates (protostar) and see if the error is present

It is not the template.
It could be in a Plugin. But shouldn't it then be somehow in the call stack?

No it does not need to appear in the call stack

It looks like (i am only guessing)
that you have a plugin that is overriding JMenuSite (it does not override JMenu instead it overrides JMenuSite and extends JMenu)

• the constructor of JMenuSite that comes with Joomla does call the parent constructor, thus $this->user is assigned,

if the overriden JMenuSite extends JMenu but it does not call the parent constructor then in this case you will get this error

you can try these:

• with a text editor tool do a recursive directory text search in joomla root folder for *.php files:
  class JMenuSite
  thus you will see if there is such a plugin

• adding some code to the constructor of JMenuSite to see if it is really called :
  echo "<pre>"; debug_print_backtrace(DEBUG_BACKTRACE_IGNORE_ARGS); echo "</pre>";
  file is: libraries/cms/menu/site.php

• but maybe better is adding this to see where JMenuSite was defined:

$reflector = new ReflectionClass('JMenuSite');
echo $reflector->getFileName();

add it above just above:
return in_array((int) $menu->access, $this->user->getAuthorisedViewLevels());

and if you find then report to the developer

Thank you.

The problem is in the Joomfish Plugin. In the file plugins/system/jfoverrides/classes32/menu.php, the parent constructor is not called and $this->user is not set.

    /**
     * Class constructor
     *
     * @param   array  $options  An array of configuration options.
     *
     * @since   1.5
     */
    public function __construct($options = array())
    {
        static $params = array();
        // Load the menu items
        $this->load();

        foreach ($this->_items as $item)
        {
            if ($item->home)
            {
                $this->_default[trim($item->language)] = $item->id;
            }

            $pkey = md5($item->params);

            if (!isset($params[$pkey]))
            {
                // Decode the item params
                $result = new JRegistry;
                $result->loadString($item->params);
                $params[$pkey] = $result;
            }

            $item->params = $params[$pkey];
        }
    }

Fix: add the line $this->user = ... from libraries/cms/menu/site.php

[...]
                $params[$pkey] = $result;
            }

        $this->user = isset($options['user']) && $options['user'] instanceof JUser ? $options['user'] : JFactory::getUser();
}

Thank you! I had an issue with Joom/LanternFish on Joomla 3.7.3 using PHP 7.0.21 and the jfoverrides hack worked.