Instead to use the MD5 of the file name do this: create a random string and associate this string in your database. Simply grab 256 bits from /dev/urandom for instance (and convert this in hex).

This has the very desirable property of not being able to guess the name of the file even if you know the name of the "object".