Realistically, it's a multiplier of the two. You can make up for a slower clock with more cores and vice versa, but the number of hashes per second is dependent on both.
Sadly, I'm not aware of any specific formula to approximate hashes per second for a given clock speed and number of cores.
It's important to note, by the way, that the one thing that won't buy you more hashes per second is the complexity of the cores. This is why Nvidia may make great cards for gaming purposes, but they suck for mining - games make better use of exotic new instructions than SHA256 does.
Update: Thanks to the table David Schwartz linked to I've been able to estimate that a theoretical AMD GPU core running at 1 MHz can calculate approximately 300 hashes per second. Therefore we can estimate hashes/sec as Cores * Clock * 300. This isn't really all that exact and it seems to over-estimate some cards and under-estimate otheres, even within the same family so I'm guessing ambient temperature and other factors were interfering with test results, but it seems to be an ok estimate in most cases. YMMV. It also fails miserably with older cards, but those get such pathetic hash rates it probably doesn't matter anyway.