2of2 multisig - redeem script required
It is, sort of, but some considerations have to be taken into account.

There are two ways of creating a multisig transaction: Pay-to-multisig, or a Pay-to-script-hash encapsulating a Pay-to-multisig. For how you are asking the question I guess that you are referring to the latter. However, I will give you both answers just in case.

Pay-to-script-hash (P2SH)

The scripts of a 2-3 multisig encapsulated in a P2SH transaction looks like:

ScriptSig: OP_0 [Sig 1] [Sig 2] OP_2 [PK 1][PK 2][PK 3] OP_3 OP_CHECKMULTISIG

ScriptPubKey: OP_HASH160 &lt;ScriptHash&gt; OP_EQUAL


As you mentioned, Bob will be able to recreate the script since the ScriptPubKey only required the hash of the generated scriptSig, and he will have all the information. However, order matters. In this case (a 2-3 multisig) Alice could have build the script in six different ways:


ScriptSig: ... OP_2 [PK 1][PK 2][PK 3] OP_3 OP_CHECKMULTISIG
ScriptSig: ... OP_2 [PK 1][PK 3][PK 2] OP_3 OP_CHECKMULTISIG
ScriptSig: ... OP_2 [PK 2][PK 1][PK 3] OP_3 OP_CHECKMULTISIG
ScriptSig: ... OP_2 [PK 2][PK 3][PK 1] OP_3 OP_CHECKMULTISIG
ScriptSig: ... OP_2 [PK 3][PK 1][PK 2] OP_3 OP_CHECKMULTISIG
ScriptSig: ... OP_2 [PK 3][PK 2][PK 1] OP_3 OP_CHECKMULTISIG


This have two consequences, the most straightforward is that if the script is not build in the same way, the hash will be different. Moreover, the order in which the keys are provided indicates how the signatures should be provided, that is, signatures and keys have to be provided in the same order.

e.g: 

ScriptSig: OP_0 [Sig 2] [Sig 1] OP_2 [PK 2][PK 3][PK 1] OP_3 OP_CHECKMULTISIG


Then, in a n-m multisig, Alice will have n! ways of arranging the Public keys. If not provided in the right order, the evaluation of the script will fail, making the transaction invalid.

Pay-to-multisig

In the case of Pay-to-multisig, the solution is way more straightforward due the information that each script stores. Using the same 2-3 multisig example, the resulting scripts will be:

ScriptSig: OP_0 [Sig 1] [Sig 2]

ScriptPubKey: OP_2 [PK 1][PK 2][PK 3] OP_3 OP_CHECKMULTISIG 


In this case, not just the latter, but every party involved will know how to build the ScriptSig, since how the ScripPubKey was build is accessible from the previous transaction.