Unguessable UID are hard... Remember that the attacker can often afford to be patient, so he can make a lot of attempts with various potential UID values. In order to make UID truly unguessable by the attacker, you would have to generate them at random in a large enough space: this means using a cryptographically strong PRNG (your server already has one, called
/dev/urandom on Unix-like systems, or
CryptGenRandom() on Windows) and making the UID large enough so that the attacker will not hit one "by chance" (so it would have to be, at a minimum, 12-byte long, preferably more).
Unless you use such fat, random UID, you cannot rely on UID being unknown to the attacker.
Another point, which others have made, is that the CSRF token is, by nature, a piece of data which is sent by the client along with his request (the request will be accepted by virtue of coming with that token). Therefore, if the UID is the CSRF token, then it has gone through the client... at which point, we can only assume that the attacker got a copy of it. This is the whole idea behind the concept of "secret tokens should last only a short time": to make the life harder for the attacker, by shortening the time window during which a grabbed secret token can be used. The UID is long-lived, thus not appropriate in that role.