I myself have committed with a hash of 0000000 into a git repository twice, meaning it is easy to confuse those two commits.
An attacker would merely have to brute force the tip of their attacker repository, a matter which you can do within the hour on a stock standard PC.
So you think, that you can do so in a hour? How much are you willing to bet on that?
For bonus points try to "brute force a tip" for repository, containing actual contents (as opposite to randomly named binary files with gibberish).
I cloned this repo: https://github.com/bradfitz/gitbrute
Ran the command in the readme (had to do it twice for some reason) and the latest commit is now 000001 on my fork of the repo: https://github.com/Genbox/gitbrute/commit/0000019075dabc337f...
It took less than 3 minutes for the full thing.
As I said trivial to prove valid; and since I was actually reading, using, and compiling the code, quite difficult to achieve a collision in the circumstances.