If you have two inputs of the same length, are there theoretically collissions in both MD5 and SHA-256?
It is possible such collisions exist, but because SHA-256 is collision resistant, finding any collisions would be computationally infeasible.  You may safely assume without further checking that if two files have the same SHA-256 hash, then they contain the same content.
You can so safely assume that, given current cryptographic knowledge, that there's no reason to use MD5 at all; you can just use SHA-256.  In fact, you should actively avoid MD5 if at all possible.