Digital Signature Attack
If the adversary gets a signature on $m_1$, then it's true that the adversary could claim the signature is a signature on both $m_1$ and $m_2$, if $h(m_1) = h(m_2)$ (i.e., there is a collision). The adversary does not need the private key to make this claim, anyone holding the public key should be able to verify the signature.

The reason the adversary can successfully make this claim is that the signature does not actually sign the message, it signs the hash. So since $h(m_1) = h(m_2)$ the resulting signature is in fact both a signature of $m_1$ and $m_2$.

The reason why this is not usually a problem is that the hash function $h$ will be chosen as a cryptographic secure hash function meaning that it should be (practically) impossible for the adversary to find such a collision.