The problem is that, imagine you sign a message $m$ using ECDSA and SHA-1 as hash algorithm. If an attacker manages to find a message $m'$ such as SHA-1$(m)$ = SHA-1$(m')$ then the computed signature for $m$ will be valid for $m'$.
So the attacker can substitute $m$ for $m'$ while keeping the same signature value. The receiver who will try to validate the signature won't be able to tell the difference.
[UPDATE]
Let's explain it in details:
So when signing a message $m$ using ECDSA algorithm with SHA-1 hash function, according to wikipedia, it goes this way:
- We compute $e =$ SHA-1$(m)$
- Calculate $r = x_1\,\bmod\,n$ (where $(x_1, y_1) = k \times G$, $k$ is a random integer from $[1, n-1]$ and $n$ is the order of the elliptic curve)
- Calculate $s = k^{-1}(z + r d_A)\,\bmod\,n$ (where $d_A$ is the private key signature and $z$ the $L_n$ leftmost bits of $e$)
- The signature is the pair $(r,s)$
So if an attacker finds a message $m'$ as SHA-1$(m')$ = SHA-1$(m)$ then $e' =$ SHA-1$(m') = e$ and then $z' = z$.
So the signature $(r,s)$ will be valid for the message $m'$ even if the attacker doesn't know the private key $d_A$ because all computations have been done for him.
Note that in this case the attacker needs a valid signature and to find a second pre-image to forge a signature.
An interesting comment from Ilmari Karonen:
There are practical scenarios where both $m$ and $m'$ may be
controlled by the attacker, in which case a collision attack suffices.
For example, the MD5 collision attack was used to forge SSL
certificates by getting an established CA to sign an innocent-looking
certificate, and then replacing it with another certificate with the
same MD5 hash, but far higher privileges.