with only six characters to brute force, it's possible to scan all the URLs associated with a cloud service, locate the open shared folders, and poison them with malware while you plunder them for secrets.
Enforcing that obscurity is NOT an effective measure:
security-through-obscurity method of relying on secret URLs leaves users vulnerable to attacks
And as Ron Popeil would say “But wait, there’s more”
By brute-forcing all Google Maps shorteners, you can discover peoples' private addresses and lots of other sensitive information.
Remember people, the Cloud is just someone else’s computer sitting in someone else’s closet. Thread lightly.