If you have two inputs of the same length, are there theoretically collissions in both MD5 and SHA-256? Can there be two messages M, M' both of the same length such that both MD5(M)=MD5(M') and SHA-256(M)=SHA-256(M')?
Let's compare two files: if they have the same length, they are candidates for having the same content; if they share the MD5 sum they are stronger candidates for having the same content (I understand there are MD5 collisions on same-size inputs so this could lead to a false positive), but then if they also share a SHA-256 sum, can I be certain the files have the same content?
It is possible such collisions exist, but because SHA-256 is collision resistant, finding any collisions would be computationally infeasible.  You may safely assume without further checking that if two files have the same SHA-256 hash, then they contain the same content.
You can so safely assume that, given current cryptographic knowledge, that there's no reason to use MD5 at all; you can just use SHA-256.  In fact, you should actively avoid MD5 if at all possible.