This has been shown by security researchers to be quite possible, and a serious vulnerability in many popular web applications. Not only could pages be guessed,

This has been shown by security researchers to be quite possible, and a serious vulnerability in many popular web applications. Not only could pages be guessed, they can build an entire state machine of the web application and use side channel attacks to guess what a user is sending in their HTTP requests. Side-channel leaks in web applications: A reality today, a challenge tomorrow : http://lasr.cs.ucla.edu/classes/239_1.fall10/papers/WebAppSideChannel-final.pdf http://lasr.cs.ucla.edu/classes/239_1.fall10/papers/WebAppSi...