Just realized:

tmp_str = ''
tmp_str = tmp_str + city[x] + ':'

Can be shortended to:
tmp_str = city[x] + ':'

Oh well.

Yep, it's all about math, but during thinking and probing begin to understand the function reduce much better. And when realize that it's all about max - min, reduce become your close friend. I felt a bit upset that reduce is not the best way to solve this kata. ))

someone has gone and switched their heads and tails around

As simple as that, sometimes reading the instructions a second time or asking helps you.

Personally I find it was explained poorly. I thought the entries were randomized so I wandered off with code that wasn't working but then I check the answers and it was just simply to be reversed. My lord, I overcomplicated it for nothing.

Goodbye, invalid solution ;-)

you can declare a regex outside of your function if you use ES6 so you only compile the regex once, instead of on each call.

This is not a known JS practice at all (as a rule of thumb, if most reputable sources doesn't suggest a practice, it's either not a practice or it's negligible). Even if this is true in every other language it does not make such better practice in this language. It's a invalid suggestion.

the readability is pretty terrible

If you can't read simple regex like this, I'd say the problem is at somewhere else than the regex...

That fails for 5 digits numbers.

Yeah this one shouldn't have worked.

validatePIN('-12345'); // should return false, but returns true