Collision attacks aren't an issue when dealing with password hashes. The issue with both SHA256 and MD5, from a password hashing perspective is that they're both much too fast. MD5 is quite a bit faster than SHA256, in fact.
To clarify what a collision attack is, and why it doesn't matter when dealing with password hashes, it is when a hash function allows an attacker to find two inputs that result in the same hash value. The fact that the attacker can control and manipulate both inputs in order to find a colliding value is critical. When you have a password hashing system, however, the attacker does not have to ability to control the first input. The password creator controls the first input. The attacker only has the resulting hash value from the first input, and the ability to attempt to create a matching hash from a second input which they do control. If they can find a second input that creates an identical hash, this is not a collision attack, but a 2nd pre-image attack, and not even MD5 is susceptible to these.
So, ultimately, the speed is the only issue, in that people choose passwords poorly, and the speed with with an MD5 hash can be computed is rapid enough for an attacker to attempt many, many potential input candidates in order to find the one the results in the password hash.
