Private files missing filename
If server does not provide content-disposition,  especially filename part of it, browser is free to choose suggested name. FF defaults to what appears to some kind of UUID, IE to domain, Chrome bases it's guess on the script being called, as far as I can tell. On the other hand adding content disposition can prevent inline viewing of PDF files, and confuse browsers in a few more ways.

You can use hook_file_download to conditionally add header with a file name where it needs to be added:


  If the user has permission, return an array with the appropriate headers.