This seems far from "impossible".
MD5 is not malleable, but ECDSA is.
MD5 is hash-function, but ECDSA is signing
You need to re-read the post.
Of course. "Malleability" is an umbrella term for multiple issues that affect corner cases. For example. The script is hashed then signed causing a different hash if the instructions are changed but, never the less, yield the same result. The solution to this aspect, I believe, is to hash the final stack instead of the current method.