I just found two secret parameters.
To get two extra items, namely ghost and star, append &opt=6358D569C9 to the link. Or use $('body').addClass('secret') in console.
To replace Mario with Toad (only in SMB), append &opt=7F93F702E6.
By using the latter opt, and adding secret manually, you can have both.