I assume you mean
scriptPubKey in the outputs of the coinbase transaction.
Assuming that, what you are describing is popularly known in cryptography as a pre-image attack. If you can find a 'collision' with fixed existing message (in your example that is the original coinbase transaction) in such a way that they both produce identical hashes then you have a pre-image attack. If you change the
scriptPubKey in the output of coinbase transaction, assuming no 'collision' happens, it will change the
txid and hence change the merkleroot, which would in turn change the block header hash.
SHA-256 algorithm outputs 32 bytes, which means there are a total of 2^256 (or 10^77 combination). SHA256 is a one way mathematical function, as a result you will have to brute force your way to actually produce hash similar to the one before. Running that kind of brute force is not only computationally impossible, but also impossible due to the energy that it consumes (check this).