>possibly injuring the occupant (though the car safety features should help)

This seems to take the opposite viewpoint of the OP which said the "obvious" answer is to do whatever is best for the passengers.

>one that isn't wildly unlikely ever to happen.

A lot of the comments here are along these lines and, to a certain extent, they miss the point. Risk is a combination of probability and severity even before considering ethics. In the cases where probability can be reliably calculated, there needs to be threshold about what risks are accepted in order to implement informed decisions. I'll try to illustrate a couple examples.

Say there is software that decides to take a specific action based on sensor input. Maybe the action is to accelerate and swerve to the left if an obstacle is detected to be oncoming from on the right at an intersection. Let's make it somewhat more complicated by having a jaywalker stepping off the curb on the left. There are (at least) two prospective events:

1) The car does not perform evasive maneuvers and increases the risk of being hit by the other vehicle
2) The car does perform evasive maneuvers and increases the risk of hitting the pedestrian

Each has a probability and a severity. To make things simple, say the probability of each is 5%. However, they have different severities. In scenario 1) the severity to the pedestrian may be risk of injury or death even if the severity to the driver is fairly low (probably repair work covered by insurance). But in scenario 2) the severity to the pedestrian is negligible while the severity to the driver(s) is moderate. With modern cars, it's unlikely either driver will be killed is fairly small but there is an increased risk of sub-fatal injuries and likely much more damage to the vehicles.

Remember, the risk = probability x severity. So if we take the simplistic approach of only taking in the perspective of the driver ("do whatever favors the passengers of the car") we have effectively minimized the passengers risk of moderate injury by increasing the pedestrian risk of grievance injury. Adding ethics gets even more complicated; does it change if the pedestrian is a child? A mother pushing a stroller? A homeless person?

Another example would be what if the car is driving by a school playground and notices a ball roll between parked cars and into the road? A human can intuit playground + ball = a higher probability a child may run into the street after the ball. This might be enough to cause a human driver to apply the brakes hard even if a child isn't immediately visible. Would software intuit the same? Even if it did, would the car do the same if it increased the risk of a collision from behind?

The safety-critical software world spend a lot of time on small-probability events. The more recent 737-Max issue has similar through-lines, though there are many confounding issues as is typical with safety mishaps. The MCAS was classified as "hazardous" severity and by company policy required two AOA sensors to reduce the probability of failure. This would effectively reduce the risk since risk = probability x severity. However, since the severity was "hazardous" and not "catastrophic" (i.e., they didn't think it could cause a plane to crash), the extra sensor was an optional software feature. Had the severity been appropriately attributed, I think there is a greater likelihood that the second AOA sensor would be a mandatory feature because they (I assume) have a specific risk threshold they are aiming for. All this to say, it's not enough just to say "These are small probability events so they don't have to be addressed" but rather probability is just a part of an overall risk strategy.

The decision space with safety critical software is extremely large precisely because you must mitigate low probability events if the severity is large enough. I sometimes wonder if the fact that self-driving technology targets are missed is attributable to naivety of oversimplifying the problem.