How can a public-key encryption scheme be used to construct a commitment scheme in the CRS model?
Particularly, if the probability over $Gen$ that there exists some $r_2, r_2'$ with $Enc(pk, b, r_2) = Enc(pk, 1-b, r_2')$ is negligible, then this almost works.


Actually, if the public key $pk$ is a valid public key (that is, corresponds to an actual secret key), the probability is 0.

Here's why: we have $Dec(sk, Enc(pk, x, r)) = x$ for all $x, r$.  Hence, $Dec(sk, Enc(pk, b, r_2)) = b \ne Dec(sk, Enc(pk, 1-b, r_2')) = 1-b$, and so $Enc(pk, b, r_2) \ne Enc(pk, 1-b, r_2')$

On the other hand, this still leaves open the question of "what if the committer were to pick an invalid public key (which does allow collisions)", for example, RSA with $e$ not being relatively prime to $(p-1)(q-1)$.

Hence, if we were to use this commitment scheme, we would reveal $r_g$ as well; this allows the verifier to construct the public key for himself (and verify that the $pk$ in the commitment was done honestly).