This can give the attacker the URL of a private video, but they won't be able to access it. It could let them access unlisted videos, but I don't think that's as big a deal.