Legally (in countries I know about, Europe mostly), the liability is with the bank. They might ask if you gave your PIN to anyone else (you should not do this!) but there's no consumer liability.
The liability shift with Chip & PIN is from the bank to the merchant. If the merchant accepts an old-fashioned stripe transaction they accept the risk for themselves.
http://krebsonsecurity.com/2014/10/chip-pin-vs-chip-signatur...
I've been subject to fraud that could only have taken place because someone observed my PIN (or obtained it some other way). The actual fraud took place in another country where there is no EMV though.
I know the Cambridge research has turned up some interesting stuff - it's possible to use a man-in-the-middle between the card and the reader to convince the reader that a PIN has been entered and verified when no such thing has taken place - but I wasn't aware much of that had been seen in the wild.
--edit-- and it still involves a stolen card at that point doesn't it?
Not if they were using my PIN as that's never used online. Had to be a physical purchase to get that. As a workmate was subject to similar fraud at a similar time we figure it was probably a bar or restaurant we'd been to together, where our cards were skimmed and someone either watched or recorded us entering PIN details.