You could create the table with a placeholder name you generate, then use sp_rename @generatedName, @userName; to pass the user defined name as a parameter so that you don't have to concatenate it into a string.

You could probably do something similar with the columns you were creating. Pass them into the proc in a table variable, then iterate over them and issue a series of alter commands.

It should go without saying, but I'm sure you realize something that is altering the DB schema should probably be locked down pretty hard from the front end in any case.