Depending on your server, you might be able to disable "directory indexing", which means a person can't list out the contents of the directory. Alternatively, you can place the private images outside the document root. Create the url with a token. For the image request, use the token to look up the real image location and provide the real image.
If the token is something easily guessed, your attacker can still find the images. For example, if you use simple number like 1, 2, 3, 4, 5, I could easily guess that 6 might be a valid token.
If you use a hard-to-guess directory name, but include that in the url, that hard-to-guess name is now known.