Concatenating a hash function for generating one hash for multiple files Assuming we use SHA256 as hash function. In practice you see that a Merkle tree is used to concatenating multiple hashes together to one single root hash.

A Merkle tree is a binary tree which always takes two SHA256 hashes and concatenate them in a recursive manner.

My question: Is it insecure to hash more than two hashes together? Say for example you want to create a unique hash of a folder structure. Each folder can contain an huge amount of files which are separately hashed. If we now concatenate the hashes in a sorted way:

SHA256(concatenate(sort(SHA256(file 0), SHA256(file 1), SHA256(file 2), [...], SHA256(file n-1))))


Does this increase the risk of a collision?

Explanation: You can imagine that an attacker wants to prove that a file was part of the hashes (through the root hash) which it was not. So he can choose n-2 hashes freely and try to calculate the root hash (collision). Does this (dramatically) increasing the chance of a collision? 

I can not find precise information about that online. My stomach feeling points me to the birthday problem. And kind of the existence of a Merkle trees is pointing in the same direction. Or am I wrong? I would be really happy for any hint. Thanks!
Assuming the hash is collision-resistant (which SHA-256 is believed to be), the proposed practice of hashing the concatenation of a sorted list of hash of files is demonstrably secure against collision (argument: a collision in the final result implies a collision in the last step or/and for some file); so is the practice of hierarchically hashing a binary tree. There's no meaningful difference in security (arguably, accidental collision is more likely in the later; but that's immaterial).

Notice that the proposed practice will give the same hash if files are reordered (which clearly is intentional), or if the content of two files is exchanged while they keep their name (which could be a serious security issue: two packages with the same hash, and the same filenames, can do entirely different things when run).