If the URL you give them is a PHP script, which just passes the file through, then the "real" URL won't be visible at all.
If you don't want people poking around and stumbling across a URL which points to the file, then don't put the file in your site's directory tree; put it somewhere else in the filesystem instead.
