How much does using the same $H$ for all messages weaken GCM? How much is GCM weakened by using the same MAC key $H = E_K(0^*)$ for all messages that use the same key (which is what GCM actually does) instead of using $E_K(N||0_{32})$ (which is different for each message)?
Under the ideal cipher model, security is not diminished by any choice of value $H = E_K(d)$ for a known value $d$, as long as none of the counter values that get encrypted to generate the encryption stream is equal to $d$. This is what "ideal cipher" means: you have no information on $E_K(x)$ for any $x$ that you have not already tried to encrypt with the same key, and that goes for all such $x$; none is beter or worse than any other. Using $d = N||0_{32}$ instead of $d = 0_{128}$ would thus not make GCM any weaker. It would not make it stronger either, for all we know, because making it "stronger" would require that we know of some weakness in GCM as it is defined nowadays; and we know of no such weakness.

Now, using $H = E_K(0_{128})$ has some implementation benefits. Namely, suppose that you want a constant-time implementation of GCM, thus without any memory access whose address depends on the data or the key (this is to avoid side-channel attacks through cache misses). On a modern PC, you will want to use specialized opcodes, but on a slightly less modern x86 CPU, or on a non-x86 architecture (e.g. ARM), you do not not necessarily have access to such facilities. Classical implementations of multiplications in $GF(2^{128})$ are either very slow, or use data-dependent table lookups, which are not constant-time. A constant-time multiplication by $H$ can be implemented relatively efficiently (at about 14 cpb) with the help of tables whose contents depend on $H$ -- but that's counting without the cost of generating these tables. If $H$ depends only on the key, not the IV, then the tables can be produced as part of the key schedule, for a much lower overhead if many messages are processed with the same key.

Thus, having an IV-dependent $H$ is not known to increase (or decrease) security, but may imply larger CPU costs in some situations. This is a good reason to have a fixed $H$, that depends on the key but not the IV.



Constant-time multiplications in $GF(2^{128})$ can also be done in other ways, but that's another story. One is to use additive Fourier transforms, which yields remarkable performance in generalized bitslicing, but only in situations where many blocks can be processed in parallel, and with a large fixed overhead. Another method is to use integer multiplications on the operands, with most bits cleared to make room for carries; this can be worthwhile if the architecture at hand offers constant-time efficient multiplications. An example of such an architecture is the very-low-power ARM Cortex M0+, where additions and multiplications have the same cost (1 cycle each).

Even then, having an IV-dependent $H$ still implies some extra work for each message, since that processing cannot be shared.