I would second the idea of using a hash as the secret file name, however I would also recommend salting the hash with the current unix time. While having a collision between 2 different strings is extremely unlikely, having 2 users upload files with the same name is going to happen at some point.

I would also recommend adding a salt to stop an attacker from being able to guess URLs by hashing common filenames. Though using the time in the hash is likely to prevent this, it's low-cost and probably worth it.

So, I would recommend (in PHP):

  $url = md5( 'my_salt_string' . $time . $file_name );

But as Michael noted above, none of this can ever guarantee you security...