Are there any practical attacks that create a printable chosen prefix MD5 collision?
In general, most of the readable MD5 attacks are carried out in formats that make it possible to add non-printing elements, such as postscript. It is hard, yet possible, to create collisions going down to pure ascii or hex. However, they may or most likely will not be readable, and if the hex is doing something meaningful, e.g. assembler code, the code will most likely be faulty. 

In general, it is possible when certain bits are changed in certain positions- they have to be identified, by trial and error or looking for flaws, both in the algorithm or the implementation. 

Here is a Stack Overflow question on creating collisions: Create your own MD5 collisions