Hostnames reveal interesting information, such as potential code sinks (e.g. ldap1.internal.companyname.com would be LDAPi versus db1.internal.companyname.com, which would be SQLi). These can be extracted with the host-extract.rb tool.
Parameters reveal the same type of information, and may even speak words about the type of query. For example, I often see ASC or DESC listed as parameter names (especially on sort buttons in web apps), which would indicate an ORDER BY or GROUP BY injection type. Sometimes the parameter names are sortby, groupby, or perhaps sortorder or simply "order" or "group". These are very telling.
Additionally, some are called "limit" or "offset" which indicates the LIMIT or OFFSET part of a SQL query. A web application assessor usually assumes he or she is injecting into the WHERE clause, but it really could be in these other places.
Some parameter names give other hints, such as whether they are an integer or string.
Often, SQLi exploitation tools, such as sqlmap, Marathon, and bsqlbf-v2 will allow you to configure the attack query more specifically, and yes, knowledge of the current parameter keys and values certainly helps when testing them, especially during blind SQLi testing!
File names (via a path disclosure) are even more obvious. They can be used to discern whether or not a popular open-source (or potentially closed-source if you read a lot of code!) package or component is installed on a web server. You can usually get down to the specific version. InspathX and WhatWeb utilize these techniques -- inspathx to identify path disclosure vulnerabilities and WhatWeb, well let's just say that WhatWeb can do a lot!
Since about half of the tools that I mentioned in this answer cite tools made by current members of the YGN Ethical Hacking Group, you should check out their Research area and Lab (accessible from their main webpage).
The authors of "Hacking Exposed Web Applications, 2nd Edition" (Note that the third edition is out, where additional up-to-date information is available) are referring mostly to custom directory/file brute-forcing lists, as well as Direct Object References (i.e. OWASP T10 Forced Browsing, OWASP T10 Failure to Restrict URL Access, OWASP Insecure Direct Object References, or WASC TC Predictable Resource Location).
In other words, if you see something like
http://owaspbwa/external/ you could also check for the existence of
http://owaspbwa/internal/ or similar.