Why would you use a weaker hash function than cipher strength? Some cryptographic libraries (like “Bouncy Castle”) support many modes where the maximum number of bits which can be produced by the hash are significantly fewer than the cipher strength.  For example:


MD5 (128 bit max) is paired with 256 Bit AES
SHA1 (160 bit) max is paired with 256 Bit AES


What benefit is derived from using 256 bit AES over 128 Bit AES in cases like this?
Well, firstly, SHA-1 still seems to have 160-bit preimage and second preimage resistance, so using it in HMAC requires more than 128-bit AES keys to get equivalent security.

AES 192 would be sufficient, but isn't used in e.g. TLS – RFC 3268 says:


  The AES supports key lengths of 128, 192 and 256 bits.  However, this
     document only defines ciphersuites for 128- and 256-bit keys.  This
     is to avoid unnecessary proliferation of ciphersuites.


So with AES and SHA-1, you can pick between either MAC security (AES-256) or cipher security (AES-128) being the limiting factor.

As for MD5, there are no TLS cipher suites with AES + MD5 at all. In the case of password-based encryption, where a combination of MD5 and AES-256 is defined in Bouncy Castle, it's definitely a legacy algorithm. 



In general, there's a difference between the integrity offered by the MAC (which the hash functions are used for here) and the privacy offered by the cipher. If you valued privacy above integrity, you could have a higher minimum security you desire from the cipher. An attack on the MAC would frequently have to be online, while an attack on the cipher could be done offline, even years after the fact.

Also, the MAC length requires space in each message, while the key length of AES does not, so you might want to use a short MAC even if you were fine with long keys and the resulting processing time.