Assume that there is a smartcard or other hardware token that exposes the raw RSA private key operation (modular exponentiation, with or without CRT parameters). Is there any possibility that raw RSA leaks information about the private key that would not otherwise become available?
Please clearly distinguish between attacks on the algorithm itself and side channel attacks. This question is not about the security of unpadded RSA signatures themselves.
As far as we know, no: from a mathematical standpoint, exposure of the raw RSA private key operation does not leak the private key, or anything allowing to perform the raw RSA private key operation (such as another private key, or a factorization of the public modulus). We have no proof; but this has been well studied, and any advance in that direction would make the headlines.
Things can be very different in practice, where you have to consider side channel and fault injection attacks. There are so many such attacks around, and they depend so much on the implementation (hardware, CRT or full modulus, Montgomery or straight arithmetic, blinding(s), randomized exponent scanning, other countermeasures..) that I pass on that part of the question.
