How to make links to private directory always use ssl?
Depending on where you've placed the above code (e.g. a hook_init invocation), it might not trigger for an anonymous user if caching is involved on your site.

An alternative to this approach is to do it at the web server level so that any request that matches a URL pattern will always switch over to HTTPS. For example, with Apache RewriteRule you could do the following:

  RewriteCond %{SERVER_PORT} !^443$
  RewriteRule ^system/files/webform/(.*)$ https://www.example.com/system/files/webform/$1 [R=301,L]