That last point isn't particularly deep; the same techniques used in http://www.win.tue.nl/hashclash/rogue-ca/ http://www.win.tue.nl/hashclash/rogue-ca/ can be

That last point isn't particularly deep; the same techniques used in http://www.win.tue.nl/hashclash/rogue-ca/ http://www.win.tue.nl/hashclash/rogue-ca/ can be used for two files which are UTF-16 encoded and contains sections which are commented out. With this said, that is a collision attack and not a preimage attack and so your first point is crucial.