IND-CCA insecurity of modified CBC encrypt + MAC scheme I've been puzzling over the following proof for the past couple of days.

Since a block cipher in CBC mode can be used to build both an IND-CPA secure
encryption scheme and a EUF-CMA secure block, a common mistake made in “roll-your-own”
cryptosystems is to try to use the last ciphertext block to compute a MAC on the plaintext,
e.g. to encrypt the message m, we compute the ciphertext $c = \verb|CBCEncrypt|^E
_K(m)$, let $c^∗$ be
the last block, compute tag $\tau = E_K(c^*)$. and use $⟨c, τ⟩$ as an “authenticated encryption”
scheme. Prove that this scheme fails to provide chosen-ciphertext security.

I'm making the assumption that an encryption oracle for $\verb|CBCEncrypt|^{E}_K(m)$ uniformly chooses an IV and then makes it public after encryption. Also, $E_K$ is the block function.
One security issue that comes to mind is that the tag of a message in this scheme relies only on the last block of ciphertext, not the rest of the message. However, since each IV is random and unpredictable, I don't see how an adversary could exploit this.
Another thought I had was if an adversary could compute a valid tag $\tau_{\tau}$, then they could decrypt $⟨\tau, \tau_{\tau}⟩$ and check whether or not the resultant decryption (with IV=0) is equal to the last block of the corresponding ciphertext $\tau$ was generated from. But again, I can't see how an adversary could compute $\tau_{\tau}$.
Any help would be appreciated.
One security issue that comes to mind is that the tag of a message in this scheme relies only on the last block of ciphertext, not the rest of the message.

So, what would happen if the adversary took a valid $⟨c, \tau⟩$ pair and modified $c$ by repeating the last block, that is, converting it into the pair $⟨c || c^*, \tau⟩$ and forwarding that to the decryptor?
Would the modified ciphertext pass the integrity check?
Bonus question (to make the attack even worse): if it did, what would the resulting plaintext look like?