Once they have a collision in the sha1 portion, making changes so the md5 portion also collides should only take a few CPU seconds.