A couple of things concern me about your question.
Firstly, regular users such as SCOTT should not be creating directories. The CREATE ANY DIRECTORY is extremely powerful, because it confers read/write privileges on any OS directory which is accessible to the oracle
account; this is a massive security hole.
Secondly, the directory path must be just the path, without a file. We create files using UTL_FILE, Data Pump or whatever. A call to UTL_FILE.FOPEN()
will fail if the passed DIRECTORY is actually a path to a file not an OS directory.
I cannot explain why the same statement executed successfully by SYSTEM fails when executed by SCOTT. I don't have 9i to hand, so I cannot test it. Please cut'n'paste the whole SQL*Plus output so that we can see what happens. As Peter has noted, your question appeared to contain a typo, so at the moment we cannot be certain that what you think is happening actually is what is happening.