<a href="http:&#x2F;&#x2F;joeyh.name&#x2F;blog&#x2F;entry&#x2F;size_of_the_git_sha1_collision_attack_surface&#x2F;" rel="nofollow">http:&#x2F;&#x2F;joeyh.name&#x2F;blog&#x2F;entry&#x2F;size_of_the_git_sha1_collision_...</a> has some discussion of colliding tree objects.