When a marketing list has a '&' in it's name standard/non system admin users are not able to create campaign activities against it. If you remove the '&' it works fine.