Are AES-256's related-key weaknesses exploitable if it is used to build a hash?
The most efficient related-key attacks on AES-256 and resulting weaknesses AES-256-based hash functions are summarized in my PhD thesis. Though collision and preimage attacks on hash functions are out of reach yet, the components of these functions still expose some properties that are not expected of good hash functions or random oracles.

Getting to the details, the key schedule of AES-256 allows for numerous related-key differential trails with the most probable one covering as few as 19 S-boxes (page 96) and probability $2^{-119}$. By playing with the first rounds of this trail, one can get various properties of the AES-256-based compression function
$$
F(IV,M) = AES_{M}(IV)\oplus IV
$$ holding with rather high probability.

For example, one can fix values $\Delta I$ and $\Delta M$ and produce a number of pseudo-collisions $\{(IV_i,M_i)\}$ such that  for all $i$:
$$
F(IV_i,M_i) = F(IV_i\oplus \Delta I, M_i\oplus \Delta M).
$$

It can be proved that constructing $q$ such pseudo-collisions with the same $(\Delta I,\Delta M)$ requires almost $2^{n}$ work when $q&gt;2$, whereas for AES-256 in the Davies-Meyer mode the complexity is about  $q\cdot 2^{67}$.

Though this is not a direct threat to the full hash function, a malicious designer may select an IV to maximize the differential properties of the first round. Among nothing-up-my-sleeve values there must be some that allow for higher-probability differential trails.