If the CREATE ANY DATABASE permission (mentioned in a comment above) isn't fine grained enough or your paranoia level is high then I wouldn't recommend that approach.
Personally, I avoid granting permissions to users if at all possible. It's much easier to audit Sql Server security if users have no special permissions, only role memberships. In the cases where a user does require elevated permissions, I recommend using a certificate signed stored procedure. When a signed sp is executed the user inherits permissions from the cert. (See http://msdn.microsoft.com/en-us/library/bb669102.aspx for details.)
--Skeleton of a "secure" Stored Procedure to create databases
CREATE PROC CreateNewDatabase (@db_name sysname)
SET NOCOUNT ON
--Validate database name starts with "UserDB_"
if @db_name not like 'UserDB[_]%'
--Create database, with known settings for recovery, filesize, growth, containment, etc.
declare @sql nvarchar(4000)
set @sql = N'CREATE DATABASE ' + .....
exec sp_Executesql @sql
--Grant permissions to the login
--Add DB to Maintenance plans and backup jobs, take full backup to start log chain.
--Send notification to DBA that a new DB has been created
--Etc, etc, etc.
Likewise, a different stored procedure could take care of dropping the DB when they are done with it. It could perform any required cleanup tasks like saving a final full backup to an archive folder or sending notification emails.
This is a good approach when you want to delegate a very specific task to a non-dba, for example, to allow the helpdesk to reset passwords for a subset of sql logins.