It depends on which version of GUID it is. Only version 3 and 5 are hash based. The other versions are random, time, and/or MAC address based. Version 3 uses MD5 and its cheap to get the same hash for different images: https://crypto.stackexchange.com/questions/1434/are-there-tw...

Collision only detectable when you have both messages. Detecting a forgery seems more likely.

> Adding it to a second image would cause a detectable collision

So? Still the weapon worked.