I think you should be able precalculate the IPFS address of a file before publishing it to the network. You can mint the token with this URI and only afterwards publish the file.
Although I don't really see why someone would buy this token without seeing the file first.