If Google is using their toolbar and/or Chrome to report private URLs back to Google for indexing, then that's a much more serious privacy violation than what's being reported here.
A "private" URL should surely require a login or at least have a robots.txt, no?
Plenty of sites use URLs like http://example.com/sd8n9g9g rather than require logins for private / semi-private material. What's wrong with that?
It's a pretty bad practice. I guess for semi-private material it's okay, but otherwise that's liable to leak. The biggest hole in it is referrers leaking to other sites, but I can think of other methods (eg probing the CSS history exposure bug).
Or a noindex <meta> tag
Which is why you aren't allowed to have Google Toolbar or Google Desktop installed on US Govt computers.