It can work - for a while...
Host header for a domain that is not directly resolvable means anyone not knowing the correct header and IP will not be able to open the service. This will work until both the secret domain and IP leaks, and that can take a long time.
Besides external DNS and certificate transparency that Esa Jokinen already pointed out, there's the
Referer with your hidden domain, so any site you link will know the existence of it.
But it's only part of the problem. Knowing the domain means nothing if the IP address of the server is not known, and that is more difficult to accidentally leak.
Client-side leaks will leak the secret domain, but the IP address of the server must be leaked from the server side (or by someone publishing both the IP and secret domain somewhere). And the methods for uncovering this are more difficult to pull of.
In the case of Tor secret services, you don't need to know the server IP to be able to attack it: Tor connects you to the server without the need of IP. But on your hidden service, one would need to connect to the server first to later be able to attack it somehow and get its IP. But you cannot connect to it without the IP, and you need the IP to get the IP.
How to find your server? Bruteforce... Connect to every public IP alive, send the
Host header with the secret domain and see what gets back. Can take a while but will find it.
I would not rely only on this for security, as it's security thru obscurity, but in this case is very obscure.