Imagine the following:
Client C wants to communicate with server S. The evil attacker A is the Man-In-The-Middle.
C sends a request to S, A intercepts it. A creates a self-signed certificate with the domain-name of S and sends the certificate to C, while spoofing the Source-IP to the IP of S.
C and A perform the handshake (C thinks that A is S), A can decrypt requests made form A and forwards them to S (via HTTP or HTTPS). S's responds are treated the other way round.
C sees the warning that the certificate is self signed, but who cares, really?
Since the connection between C and A is via SSL, HSTS should not be a problem.
Is this possible? Or am I missing anything?