This question is a variant on Given a message and signature, find a public key that makes the signature valid, which discusses the analogous question for RSA. It was suggested to me by this post over on Bitcoin.SE.
Suppose we are given an ECDSA signature $S$, a message $M_1$, and a public key $P_1$, such that $S$ is a valid signature of $M_1$ with $P_1$. Let $M_2$ be another message. Is it known whether we can feasibly find another public key $P_2$ such that the same $S$ is also a valid signature of $M_2$ with $P_2$?
Is there a general name for this kind of an attack (on a general signature algorithm)?
What would be the practical implications of such an attack? I can't think of any obvious way to use it to cause mischief, but I may just not be creative enough.
(Apologies if this is well-known or if my terminology or notation is bad. I am a mathematician but not a cryptographer.)
Edit: Thanks to Ricky Demer for the link to the paper by Pornin and Stern (see comment below). In their terminology, if I have it right, this attack is called a second key construction, and a vulnerable signature algorithm is said to lack destructive exclusive ownership. They also describe a way that an attacker could use this to produce a fake revocation of a victim's X.509 certificate.