Hopefully not. Even if we ignore the possibility of hash collisions (since that's not that likely yet with SHA 256).. There's still the issue of cross origin data leakage. Using a known hash and whether a request is made for the resource to tell if a user has visited another website.
This should require a cors header
(Legitimate) Site A sends file a.com/image.png w/ a hash.
(Attacker) Site B sends file b.com/image.png w/ identical hash. If no request is made for b.com/image.png, the attacker knows the visitor has gone to Site A.
Another benefit of identify resources by their hash is that we don't need to request them from a specific host. Instead, you can get them from any CDN that has a matching resource.