Do you have any idea what time window they had to generate collisions in?

The MS article on the collision says the attack required knowledge of, among other things, the predictable serial numbers. They could have had as little as the usual inter-cert issuance time, or in the worst-case scenario with entirely predictable numbers could have had months or more.

Depending on the window the funds required would change dramatically.