If an attacker can guess the name of an uploaded file, they could try to download it before the user does.