Yes you can with a number of caveats, risks, etc. What do you think the precautionary measures to be taken are? What do you think the consequences are?
Hints: If your performance test includes stress - what might this do to the users of production? If your test is not stress and it uses production data, what might happen to critical production data? What happens if you delete, insert, or modify end-user data records?
Again - the above is just a hint and far from comprehensive.
Laura, your response explains what should happen, to test in the environment that will become the production environment. I suspect that this may confuse the original question, where I would say "NEVER" simply because the person obviously is not clear on the consequences. What you do is to promote the test system to production status after it is fully checked out, which is the way it should be done. And of course you would never do a full functional test because many types of actions can only be done once, while stress tests require transactions that can be repeated without limitation. One exception I can think of is to do a DOS attack test during off-hours to see if your front-end web servers properly throttle volume, even if there is a slight risk of upsetting some night-owl customers. Otherwise you need to also be careful of causing secondary problems due to network overloading even on servers not included in the scope of your testing. I would leave this to specialists that are properly trained to build these tests in an environment that is isolated from the normal production environment.