france Probably liable towards third parties
Let us assume Mark create a distracting package, Thaler the Thief steals it, it goes off and causes Thaler to hit Barbara the Bystander’s car.
Mark is not liable towards the thief
If Thaler sues Mark, the court will probably apply the old adage that Nemo auditur propriam turpitudinem allegans ("none shall legally rely on its own faulty conduct").
The case is somewhat parallel to Cour de Cassation, Chambre sociale, du 8 juin 1995, 93-13.958, where a widow sued for the payout of her husband’s state life insurance. The highest court said that killing your own husband excludes you from those benefits, even in the absence of a statutory or contractual basis. It is not exactly the same (suit against state insurance with a contract, vs. suit between private parties without a contract), but the determining factor (a principle of law applicable even without a statutory basis) seems similar enough.
Basic rules of liability towards third parties
If Barbara sues Mark however, this principle does not apply, so it becomes interesting. The usual test of civil liability (article 1240 of the civil code) requires (1) damage (2) caused by (3) faulty conduct.
Damage (1) is easy - that is whatever amount worth of repairs Barbara’s car needed (plus health consequences for Barbara etc.).
Causation (2) is also easy. In this hypothetical, but for the package, the car crash would not have happened.
Finally, faulty conduct (3) is a bit tougher. Mark does not need to have intended the damage to happen or be likely, per article 1241 of the civil code ("one is liable not only by one’s direct conduct, but also by one’s negligence or imprudence"). Mark clearly intended the package to go off and suprise Thaler; that this happened at an inopportune moment, though unlikely, was within the realm of possibilities.
Mark's possible defenses
Mark could argue that the package shenanigans did not in fact cause the accident. He might have had video or audio recording showing that Thaler was driving imprudently before the package went off. However, establishing that if not for the package, the crash would still have happened, with a similar intensity seems extremely hard.
Mark could raise multiple arguments to the effect that his responsibility to the final damage is very limited. Mark could, credibly, obtain a declaration from the court that the damage is due (say) for 1% to Mark and 99% to Thaler. However, in practice, this does not matter. All parties that contributed to a damage are jointly liable for the total amount (see e.g. 27 mars 2003, Cour de cassation, Pourvoi n° 01-00.850); it is likely that Thaler is broke, in which case Barbara will go after Mark’s assets for 100% of her costs, and Mark now holds a (practically worthless) claim of refund from Thaler.
Next, Mark could argue that the damage was not caused by him, but rather by a package that he no longer controlled. Relying on the first section of article 1542:
On est responsable non seulement du dommage que l'on cause par son propre fait, mais encore de celui qui est causé par le fait (...) des choses que l'on a sous sa garde.
One is liable not only from damage from one’s direct conduct, but also that caused by (...) things under one’s custody.
...Mark would read this, a contrario, that one cannot be liable for things that are no longer under one’s custody.
This would be an effective shield against liability if the package was, say, a heavy TV set with unexpectedly slippery packaging, which the thief dropped on Barbara’s car or foot. However, I doubt this would work here. Mark intended for the package to be stolen and to disturb the thief; this disturbance is very much under Mark’s control, and is the reason he spent hours rigging the package.
Finally, Mark could argue that setting porch traps is a reasonable thing to do, i.e. not "faulty conduct", no matter what its consequences are. Mark would say it is similar to putting extreme amounts of spice in one’s food in the work fridge, when one suspects a coworker of stealing it (which is legal); Barbara would say it is similar to laying out deadly trap in one’s house (which is illegal). I think Barbara has the stronger side of the argument here, given that rigging up packages is not exactly a widespread activity, and that it had in fact consequences.