Given the hash output, one can always try to get lucky, and injecting random values until a match is found. In your example, any decent password cracker should try "helloworld" and "goodbyeworld" very quickly (like, within the first second of trying) because they are extremely classic password strings.
In a more general case: given a cryptographic hash function h, and the values h(m||x) and h(m'||x) for unknown values of m, m' and x, it is not feasible to recover m, m' or x except by being lucky in the sense of the previous paragraph (attacker tries exactly m||x as input). This holds for cryptographically secure hash function, and MD5, despite its weaknesses with regards to collisions (which are irrelevant here), is still "secure enough" for that.
(Of course, one must be aware that MD5 has no "salt", so any mention of MD5-with-a-salt really means "some custom, homemade, non-standard construction that involves MD5 and a value that the designer chooses to call 'a salt'". Generally speaking, homemade constructions shall be avoided.)