Can a malicious user recieve bitcoins by first finding the proof of work of his/her transaction then releasing it
What you describe is possible, but gives no advantage whatsoever to the "attacker".

Blocks build on top of their predecessor by referencing it in their header. Thus the attacker you describe would need to update his blocktemplate whenever a new blockchain tip is published. However, then he is doing exactly the same as every other mining entity, except that he's forgoing transaction fees worth one full block.