> if I put a file (non-html, pdf, zip, or something) in a
> folder . Lets say www.xyz.com/files/zip/123.zip. This
> zip-file is not linked with any other file. I only tell a
> friend the URL so he can download the file.
> Is a third person able to find and download the file 
without
> knowing the direct URL?
The only way would be through www.xyz.com/files/zip/ (but 
of only this link is listed somewhere on the site) ; IF the 
server accepts to list directory files, and IF there is not 
yet any default page (such as index.html)

In other words, you can use this trick to hide files, yes.