Create a directory, for each hit create a symlink in it, using md5(uniqid()) . ".php" or so for the filename and link it to the real script. Every so often scan the directory for old files (probably best to run a find on a cron rather than make every 100th user wait while your script does it) and kill them.
I'm not sure, but you might be able to delete the link as soon as your script executes hence invalidating it. That'd keep garbage collection restricted to times when the user didn't submit the form.
I used this technique to monitor file downloads (although I made loads of directories with the normal filename in them as a link) while allowing the user to resume easily.
Why do you want to do this though? Do you want to validate the user and then send them to the rest of the site via an URL they have to login to get? Session cookies might be better for this, or http authentication perhaps.
