I realized a collision wouldn't help because the client would just avoid sending a request as in the normal case.

The malicious filter would have to conspicuously avoid tracking the URLs of interest.