Thanks for following up. I understand where you're coming from now. Unfortunately in this instance there's not a lot of potential for interesting discussion about the "right" way to form semi-private URLs on a host that isn't doing authentication. You need enough randomness; that's obvious. Apparently it wasn't obvious to Facebook.

PS Welcome to HN.