MD5 pre-fixing with an unkown postfix Is the MD5 prefixing attack still valuable to an attacker if he doesn't know the postfix of the string?   

For instance,  what if the following sanity check was being used:

if attacker_controlled_sanity_code == md5(attacker_controlled + secret_key)


Clearly not an RFC compliant HMAC.  Despite the fact that the attacker doesn't know the entire md5'ed message mean that the prefix attack in md5 is useless?  Is there another problem with using a broken hash function in this way?
If the attacker does not know the value of $secretkey$, he cannot predict in advance the value of $MD5( attackercontrolled + secretkey)$.  However, what he can to is create two different messages $M$, $M'$ such that:

$MD5( M + secretkey) = MD5( M' + secretkey) $

He cannot predict this common value in advance; however, if he is able to submit $M$ and observe the generated tag, he immediately knows the tag for $M'$

This is a violation of the security properties that message authentication codes are supposed to provide.