There is a TODO in mr_common.cpp in addPrivilegesRequiredForMapReduce to notice when the MR is going to create a new collection for the output and add createCollection as a required privilege in that case.

This wasn't necessary to have done for 2.4 because there was no way to have insert/update (which was necessary for MR to an output collection at all) without having createCollection. For 2.6, however, this has to be done because of user defined roles