Rogue CA Certificate MD5 Collision Control
The reason for this is because it is impossible to generate an MD5 for just any $y$, where $y$ is the output of any $x$ that isn't pre-computed. MD5 is broken but it is not completely broken. Using the common terms, MD5 is broken with regards to collision attacks, but not broken with regards to pre-image attacks.

So your assumption that "Both methods require the "to be signed" portion of the certificate to be known" is not strong enough; a block (or two) in the to-be-signed portion should be pre-computed.

The to be signed portion is usually send to the CA in a certificate request. The CA uses the information in the certificate request and creates and signs the certificate that contains the information from the certificate request. This is usually automated, so if you can get past some filters you will be send the resulting certificate. At this point you can create a certificate that contains different information by altering the pre-computed block to create the correct MD5. Because the MD5 hash doesn't change the signature remains valid.

So the attack that's most potent is to pre-generate a certificate request for *.kzs8wf.com and a certain crafted public key forming the pre-computed block. You then receive the resulting certificate and then modify it to a *.google.com certificate with an re-calculated public key forming the altered pre-computed block.