> They could use this trick to sneak in a bug fix which has an unintended consequence.

They would have to have set up the hash collision beforehand. It's no longer an 'innocent file'. It's nothing something you can decide to do at a later point.