Bitcoin Transaction Protocol Question (maybe specific to Coursera Bitcoin Lecture)
It doesn't matter whose coins are funding (inputs) for the transaction the validation check still works.


  (sum of input values) - (sum of output values) >= 0


There's nothing that states sum of input values on a per user basis. As long as the total value of the inputs, no matter who or where they come from, exceeds or equals the total value of the outputs the transaction passes the check.

Update: It's not an exploit. Each transaction input is treated separately and the condition to spend each input must be met separately. If Alice supplies an input tx then she'll also have to supply a scriptSig for that single input to prove she's entitled to spend it. Likewise with Bob's transaction, he'll have to supply a completely separate scriptSig that proves he's entitled to spend his input transaction.

Alice can't spend Bob's transaction and vice-versa (unless it's a multisig, spend by anyone etc) no matter how they are combined as inputs.