Thanks all. Yes, MD5 is unreliable. But it has proven effective in identifying 1,000s of duplicate profile images in spam accounts before a single byte change throws the checksums off. Looking at the path is certainly an option, but I was worried that these may change suddenly without warning. I'll look into it.
My original post is worded aggressively because the Twitter platform* is consistently letting down people who have chosen to base their projects on it. I would dare say I was pretty annoyed at time of writing. * Platform: I refer to not just the API, but everything that makes the service what it is. Facebook have managed for years to keep the community informed of incremental changes. I would consider the addition of 6 new default profile pics to be a significant enough feature to warrant a short blog post or some other kind of heads up.
